PT-2025-51930 · Churchcrm · Churchcrm

Uartu0 · Publicado 2025-12-17 · Atualizado 2025-12-20 · CVE-2025-68112

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Crítica

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions ChurchCRM versions prior to 6.5.3

Description ChurchCRM is an open-source church management system. A SQL injection flaw exists in the Event Attendee Editor. This allows authenticated users to execute arbitrary SQL commands, potentially leading to complete database compromise, administrative credential theft, and system takeover. Attackers could extract sensitive member data, authentication credentials, and financial information. The vulnerable component is the Event Attendee Editor. SQL injection is a code injection technique used to attack data-driven applications, in which malicious SQL statements are inserted into an entry field for execution.

Recommendations Upgrade to version 6.5.3 to address this issue.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2025-68112

GHSA-HXF4-3VHP-WQCQ

Produtos afetados

Churchcrm

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68112.json · Exploit
• 🔥 https://github.com/ChurchCRM/CRM/security/advisories/GHSA-hxf4-3vhp-wqcq · Exploit
• https://twitter.com/CveFindCom/status/2001421954415276261 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2025-68112 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2002487816270541003 · Publicação no Twitter
• https://twitter.com/TheHackerWire/status/2001421324267520370 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-68112 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/2001454891630244043 · Publicação no Twitter