CVE-2024-1819 is a medium severity (CVSS 4.7) unrestricted file upload flaw in CodeAstro Membership Management System version 1.0 from CodeAstro. It affects the member photo upload. The record names no fixed version, so check the project page, patch the code yourself, or retire the application.
What's affected
CodeAstro Membership Management System version 1.0, from CodeAstro. The record lists version 1.0 only, and does not name any newer or patched release.
The description puts the flaw in the Add Members tab, where the Member Photo argument leads to unrestricted upload. The weakness is CWE-434, unrestricted file upload. The description says the attack can be launched remotely and that the exploit has been disclosed publicly and may be used.
Severity conflict. The description text, which follows the VulDB style, calls this issue critical. NVD's own CVSS 3.1 score is 4.7, which is Medium, with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L. Both ratings are published. The vector requires high privileges, so an attacker needs a privileged account first.
How to check if you're exposed
Start by finding the install and the upload folder, then look at what is stored there:
find /var/www/html -type f \( -name "*.php" -o -name "*.phtml" -o -name "*.phar" \) -path "*upload*" 2>/dev/null
Script files inside an upload directory are a red flag, because users should be uploading images, not code. If you find any you did not place there, treat the server as possibly compromised and investigate before you patch.
Also check how the web server treats that folder. If it can execute PHP from the upload path, the weakness is much more dangerous than if it can only serve static files. Review your access logs for requests to files in that folder with unusual extensions.
What to do now
- Decide whether you actually run this application. If it is unused or a demo, take it offline and delete it.
- Look in the upload directory for script files and anything you do not recognise. If you find some, isolate the host and investigate first.
- Configure the web server so the upload directory cannot execute scripts, for example by disabling PHP handling for that path.
- Restrict uploads to an allowlist of image types, check content as well as extension, and rename files on save.
- Check the project page for a fixed release. The record names none, so plan to patch the code yourself or replace the application.
Why it matters
Unrestricted upload bugs let a user put a file on the server that the developer never intended. When the file is a script and the server will run it from the upload folder, the result is code execution under the web server account. When uploads are only served as static content, the risk is smaller but includes stored cross site scripting and disk exhaustion.
The upload point here is the member photo field, a feature normally used by staff. The record rates the privilege requirement as high, so a privileged account is needed, but a compromised staff login would be enough. The safe design is to check the file against an allowlist of types, rename it on save, store it outside the web root or on a host that cannot run scripts, and require an authorised user.
The record's Known Exploited Vulnerabilities flag is false. The description says the exploit has been disclosed publicly and may be used.
Quick check
Which field is affected?
The Member Photo argument in the Add Members tab, per the description.
Is it related to CVE-2024-1818?
Same product and weakness class, different upload point. The logo handler is CVE-2024-1818.
Sources
- NVD record for CVE-2024-1819
- VulDB entry 254607 (listed in the record, not retrievable when reviewed)
Last reviewed: 19 October 2026.
