PT-2025-51868 · Churchcrm · Churchcrm

Xy20130630 · Published 2025-12-17 · Updated 2025-12-21 · CVE-2025-66395

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ChurchCRM versions prior to 6.5.3

Description ChurchCRM is an open-source church management system. A SQL injection issue exists in the src/ListEvents.php file. The WhichType POST parameter is not properly sanitized before being used in SQL queries. This allows an authenticated user to execute arbitrary SQL commands, potentially leading to the exfiltration, modification, or deletion of data, including user credentials and financial information. Any authenticated user, regardless of their privilege level, can execute arbitrary queries on the database.

Recommendations Update to version 6.5.3 or later.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-66395

GHSA-C9XF-F3GR-XFWV

Affected Products

Churchcrm

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66395.json · Exploit
• 🔥 https://github.com/ChurchCRM/CRM/security/advisories/GHSA-c9xf-f3gr-xfwv · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-66395 · Security Note
• https://osv.dev/vulnerability/CVE-2025-66395 · Vendor Advisory
• https://twitter.com/CveFindCom/status/2001376833007157404 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2001393456636182953 · Twitter Post
• https://twitter.com/CVEnew/status/2002835980680651188 · Twitter Post
• https://t.me/CVEtracker/40065 · Telegram Post
• https://twitter.com/TheHackerWire/status/2001382778454389231 · Twitter Post