PT-2025-51869 · Churchcrm · Churchcrm

Xy20130630 · Publicado 2025-12-17 · Atualizado 2025-12-21 · CVE-2025-66396

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ChurchCRM versions prior to 6.5.3

Description ChurchCRM is an open-source church management system. A SQL injection issue exists in the src/UserEditor.php file. When an administrator saves a user’s configuration settings, the keys of the type POST parameter array are not properly sanitized before being used in SQL queries. This allows a malicious or compromised administrator account to execute arbitrary SQL commands, including time-based blind SQL injection attacks, to directly interact with the database. The vulnerability is located in the logic that handles saving user-specific configuration settings. The type parameter from the POST request is processed as an array, and the key of this array is used in SQL queries without sanitization. This can be used to exfiltrate, modify, or delete data, and potentially lead to further system compromise. The vulnerability requires administrator privileges to exploit.

Recommendations Update ChurchCRM to version 6.5.3 or later.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2025-66396

GHSA-WHPP-WX64-4QP9

Produtos afetados

Churchcrm

Referências · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66396.json · Exploit
• https://github.com/ChurchCRM/CRM/security/advisories/GHSA-whpp-wx64-4qp9 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2025-66396 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2025-66396 · Nota de Segurança
• https://twitter.com/CVEnew/status/2002835979715989874 · Publicação no Twitter