The CodeAstro Membership Management System 1.0 is susceptible to unauthenticated record deletion due to missing access controls.

The delete_members.php file lacks necessary authentication checks, permitting unauthenticated attackers to delete arbitrary member records by manipulating the id parameter.

This vulnerability allows for unauthorized data destruction, which can lead to significant operational disruption and loss of data integrity. With a CVSS score of 9.8, the potential for an attacker to wipe the entire membership database is high, causing severe reputational damage and data loss.

Immediate Action: Because no patch is currently available, disable the delete_members.php functionality or restrict access to the application via IP whitelisting.

Proactive Monitoring: Monitor application logs for frequent or unauthorized requests to delete_members.php and track sudden drops in database record counts.

Compensating Controls: Implement an authentication wrapper or reverse proxy requiring valid credentials before allowing any requests to reach the administration scripts.

Public Exploit Available: Unknown

The absence of authentication on destructive administrative functions renders this software highly vulnerable to malicious activity. Organizations currently utilizing this system must apply manual access restrictions immediately, as no official vendor patch is available to remediate the root cause.