ChurchCRM is an open-source church management system. In versions prior to 6.5.3, a SQL injection vulnerability in ChurchCRM's Event Attendee Editor allows authenticated users to execute arbitrary SQL commands, leading to complete database compromise, administrative credential theft, and potential system takeover. The vulnerability enables attackers to extract sensitive member data, authentication credentials, and financial information from the church management system. Version 6.5.3 contains a patch for the issue.
The vulnerability classified as CWE-89 (SQL Injection) results from the lack of proper filtering or parameterization of input data passed to SQL queries in the Event Attendee Editor module. A logged-in user can craft malicious input data, which will be executed as part of an SQL query on the database server side. The mechanism does not require high privileges or interaction from other users, and its scope extends beyond the component where the error occurs (Scope: Changed).
An attacker can read or modify the entire database contents, including member personal data, authentication data (including administrator credentials), and financial information, which may lead to takeover of system control.
ChurchCRM must be urgently updated to version 6.5.3, which contains a patch eliminating the described vulnerability. Details are available in the vendor references: https://github.com/ChurchCRM/CRM/security/advisories/GHSA-hxf4-3vhp-wqcq
ChurchCRM in versions earlier than 6.5.3
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:NChurchcrm
APPChurchcrm< 6.5.3
Related vulnerabilities
ChurchCRM — krytyczny auth bypass w API middleware
SQL Injection w ChurchCRM przez parametr searchwhat (QueryView.php)
ChurchCRM: Path Traversal i RCE przez funkcję przywracania kopii zapasowej
ChurchCRM: pre-auth RCE przez wstrzyknięcie kodu PHP w kreatorze instalacji
ChurchCRM: ujawnienie danych logowania do bazy danych w komunikacie błędu