CVE-2025-69935 flags SQL injection in CodeAstro 1.0's admin reporting modules—specifically the fromDate parameter in report.php and revenue_report.php. The CVSS 9.8 is technically accurate for unauthenticated SQLi, but these are admin-tier modules, not public endpoints. That matters: your first question isn't whether this is 'critical'—it's whether these files are exposed to unauthenticated users in your deployment, or if they require admin session context. Check your web server routing and authentication middleware around any /report.php or /revenue_report.php paths.
The fromDate parameter is the red flag. Date-range filtering in reporting interfaces frequently uses direct string concatenation for BETWEEN clauses rather than parameterized queries—it's a known code smell in PHP reporting layers. Audit not just fromDate but every date parameter in your reporting modules: toDate, start_date, end_date, filter_date. If fromDate is vulnerable, the pattern likely repeats.
In a membership management system, these reports query the core data model: subscriber PII, payment records, organizational data, sometimes third-party integrations. One successful injection doesn't dump one table—it can expose the full relational graph. This is why the blast radius matters more than the CVSS number suggests. You're not protecting a demo app; you're protecting the data the business was built on.
The EPSS score of 0.0026 reflects observed exploitation, not exploitability. It will rise. SQLi in membership databases is prized by attackers because the data directly monetizes—PII for identity theft, payment records for fraud. Watch your access logs for anomalous report.php requests with unusual date syntax, especially UNION-based patterns. Deploy WAF rules for common SQLi signatures on these endpoints now, regardless of whether you think they're exposed.
If you run CodeAstro 1.0, treat this as a supply chain question: confirm your exact version, check the vendor for patches, and assume the reporting layer has systemic issues until proven otherwise. The fromDate pattern in two files likely means copy-paste architecture across the module.