PT-2024-28430 · Churchcrm · Churchcrm

Apena-Ba · Published 2024-07-26 · Updated 2025-04-09 · CVE-2024-39304

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ChurchCRM versions prior to 5.9.2

Description The issue is an authenticated SQL injection due to improper sanitization of user input. Authentication is required, but no elevated privileges are necessary. This allows attackers to inject SQL statements directly into the database query due to inadequate sanitization of the EID parameter in a GET request to "/GetText.php".

Recommendations For versions prior to 5.9.2, update to version 5.9.2 to resolve the issue. As a temporary workaround, consider restricting access to the "/GetText.php" endpoint or sanitizing the EID parameter to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-39304

GHSA-2RH6-GR3H-83J9

Affected Products

Churchcrm

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/39xxx/CVE-2024-39304.json · Exploit
• 🔥 https://github.com/ChurchCRM/CRM/security/advisories/GHSA-2rh6-gr3h-83j9 · Exploit
• 🔥 https://exploit-db.com/exploits/52152 · Exploit
• https://github.com/ChurchCRM/CRM/commit/e3bd7bfbf33f01148df0ef1acdb0cf2c2b878b08 · Patch
• https://osv.dev/vulnerability/CVE-2024-39304 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-39304 · Security Note
• https://t.me/cvedetector/3515 · Telegram Post
• https://t.me/cvenotify/95349 · Telegram Post
• https://twitter.com/syedaquib77/status/1909922820756287794 · Twitter Post
• https://t.me/cvedetector/1708 · Telegram Post
• https://t.me/cvenotify/87598 · Telegram Post