The CodeAstro Membership Management System 1.0 is affected by a critical SQL injection vulnerability that allows unauthenticated attackers to compromise database integrity and confidentiality.

This is an unauthenticated SQL injection flaw located in the renew.php file. By manipulating the membershipType parameter, an attacker can execute arbitrary SQL commands against the backend database.

The ability for an unauthenticated attacker to inject arbitrary SQL queries poses a severe threat to business operations. This vulnerability could lead to the unauthorized extraction of sensitive member data, modification of system records, or total compromise of the application database. Given the CVSS score of 9.8, this flaw represents a critical risk to data confidentiality and integrity.

Immediate Action: Since no official patch is currently available, administrators should restrict access to the affected renew.php script or disable the Membership Management System until a secure update is provided by the vendor.

Proactive Monitoring: Monitor web server access logs for anomalous requests to renew.php, particularly those containing SQL syntax characters such as single quotes, semicolons, or comment indicators.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common SQL injection patterns targeting the specified parameter.

Public Exploit Available: Unknown.

Given the critical nature of this SQL injection vulnerability and the lack of a verified vendor patch, organizations must treat this as a high-priority risk. Immediately implement compensating controls to block malicious traffic and evaluate whether the product can be taken offline until a secure version is released.