A critical SQL injection vulnerability in CodeAstro Membership Management System 1.0 allows unauthenticated attackers to compromise sensitive database information.

This is an unauthenticated SQL injection vulnerability located within the 'print_membership_card.php' script. An attacker can manipulate the 'ID' parameter to execute arbitrary SQL commands against the backend database.

Successful exploitation allows an unauthenticated remote attacker to extract sensitive user data, modify database contents, or potentially gain full control over the application backend. With a CVSS score of 9.8, this flaw represents an extreme risk to data confidentiality, integrity, and availability, likely resulting in significant regulatory and reputational damage.

Immediate Action: As no official patch is currently listed, users should immediately restrict access to the 'print_membership_card.php' file or disable the affected functionality.

Proactive Monitoring: Monitor database query logs for anomalous patterns, specifically looking for SQL syntax characters or unexpected union-based queries originating from the web server.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules specifically configured to block SQL injection patterns targeting the 'ID' parameter.

Public Exploit Available: Yes — a public proof-of-concept repository is available on GitHub.

Given the critical severity and the availability of public exploit code, organizations using CodeAstro Membership Management System 1.0 must take immediate action to isolate the vulnerable component. Until the vendor provides a formal security update, the risk of data exfiltration remains high and requires active mitigation strategies.