CVE-2024-25867

The vulnerability exists in the add_type.php component, where the membershipType and membershipAmount parameters are passed to database queries without proper validation and sanitization of input data. An attacker can inject malicious SQL commands directly through these parameters, manipulating the logic of database queries. The attack is possible remotely, without authentication, over the network (AV:N, PR:N), which significantly lowers the threshold for its execution.

An attacker can gain unauthorized access to sensitive data stored in the database and modify its contents, leading to a breach of confidentiality and integrity of system data.

Apply patches available from the vendor according to the references. Additionally, it is recommended to implement SQL query validation and parameterization mechanisms (prepared statements) and restrict access to the add_type.php component at the firewall or web server level until the patch is applied.

CodeAstro Membership Management System in PHP v.1.0