An unauthenticated vulnerability in the CodeAstro Membership Management System allows attackers to bypass security and access arbitrary user membership card data via direct parameter manipulation.

This vulnerability is an insecure direct object reference (IDOR) flaw located in the print_membership_card.php file. Unauthenticated attackers can trigger this issue by sending direct requests with a manipulated id parameter to the vulnerable endpoint.

The exploitation of this flaw leads to unauthorized disclosure of sensitive member information, which poses a significant risk to user privacy and regulatory compliance. Given the CVSS score of 7.5, this high-severity issue could result in reputational damage and legal consequences if an attacker successfully scrapes membership records.

Immediate Action: As no official patch is currently identified, administrators should restrict public access to the print_membership_card.php file or disable the affected module entirely until a vendor update is released.

Proactive Monitoring: Review web server access logs for anomalous, high-frequency requests directed at the print_membership_card.php script, particularly those involving sequential or randomized ID parameters.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to intercept and block direct requests to the vulnerable file from unauthorized IP ranges or non-authenticated sessions.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the researcher's write-up referenced in the CVE record.

Given the high severity and the availability of a public proof-of-concept, organizations running CodeAstro Membership Management System 1.0 must prioritize the mitigation of this flaw. Administrators should monitor vendor communication channels for official security updates and implement the suggested access restrictions immediately to prevent unauthorized data exfiltration.