CVE-2026-36387
Remote Code Execution in CODEASTRO Membership Management System
Publication date: 2026-05-07
Last updated on: 2026-05-07
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| codeastro | membership_management_system | 1.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-434 | The product allows the upload or transfer of dangerous file types that are automatically processed within its environment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Remote Code Execution (RCE) issue found in the CODEASTRO Membership Management System version 1.0, specifically in the /add_members.php file. It arises from improper sanitization of files uploaded through the system's file upload functionality, which allows attackers to inject malicious files.
By exploiting this flaw, an attacker can execute arbitrary code on the affected system remotely.
How can this vulnerability impact me? :
This vulnerability can have severe impacts including unauthorized remote code execution on your system. An attacker could potentially take full control of the affected server, leading to data theft, data loss, system compromise, or further attacks within your network.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability is a Remote Code Execution (RCE) issue in the file upload functionality of CODEASTRO Membership Management System v1.0, allowing attackers to inject malicious files.
Such a vulnerability could potentially lead to unauthorized access or manipulation of sensitive data, which may impact compliance with data protection regulations like GDPR or HIPAA by compromising confidentiality and integrity.
However, the provided information does not explicitly describe the direct effects on compliance with these standards.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves improper file sanitization in the /add_members.php file upload functionality of CODEASTRO Membership Management System v1.0, which can lead to remote code execution.
To detect this vulnerability on your system, you can monitor for suspicious file uploads or unexpected files in the upload directories related to the /add_members.php endpoint.
Specific commands to detect exploitation attempts might include searching web server logs for POST requests to /add_members.php or scanning upload directories for files with unusual extensions or content.
- grep "/add_members.php" /var/log/apache2/access.log
- find /path/to/upload/directory -type f \( -name "*.php" -o -name "*.phtml" \) -exec file {} \; | grep -i "php script"
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include disabling or restricting the file upload functionality in /add_members.php until a patch is applied.
Implement strict file type validation and sanitization to prevent malicious files from being uploaded.
Additionally, monitor and restrict permissions on upload directories to prevent execution of uploaded files.
Applying any available patches or updates from the vendor as soon as they are released is also critical.