Churchinfo · Churchinfo · CVE-2005-2473
**Name of the Vulnerable Software and Affected Versions**
ChurchInfo (affected versions not specified)
**Description**
The issue allows remote attackers to execute arbitrary SQL commands via various parameters to different PHP files. The vulnerable parameters include `PersonID` to files such as `PersonView.php`, `MemberRoleChange.php`, `PropertyAssign.php`, `WhyCameEditor.php`, `GroupPropsEditor.php`, `Reports/PDFLabel.php`, and `UserDelete.php`. Other vulnerable parameters are `DepositSlipID` to `DepositSlipEditor.php`, `QueryID` to `QueryView.php`, `GroupID` to `GroupView.php`, `GroupMemberList.php`, `MemberRoleChange.php`, `GroupDelete.php`, `/Reports/ClassAttendance.php`, and `/Reports/GroupReport.php`. Additionally, `PropertyID` to `PropertyEditor.php`, `FamilyID` to `Canvas05Editor.php`, `CanvasEditor.php`, and `FamilyView.php`, as well as `PledgeID` to `PledgeDetails.php` are also vulnerable.
**Recommendations**
At the moment, there is no information about a newer version that contains a fix for this vulnerability.