PT-2025-51869 · Churchcrm · Churchcrm

Xy20130630 · Published 2025-12-17 · Updated 2025-12-21 · CVE-2025-66396

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ChurchCRM versions prior to 6.5.3

Description ChurchCRM is an open-source church management system. A SQL injection issue exists in the src/UserEditor.php file. When an administrator saves a user’s configuration settings, the keys of the type POST parameter array are not properly sanitized before being used in SQL queries. This allows a malicious or compromised administrator account to execute arbitrary SQL commands, including time-based blind SQL injection attacks, to directly interact with the database. The vulnerability is located in the logic that handles saving user-specific configuration settings. The type parameter from the POST request is processed as an array, and the key of this array is used in SQL queries without sanitization. This can be used to exfiltrate, modify, or delete data, and potentially lead to further system compromise. The vulnerability requires administrator privileges to exploit.

Recommendations Update ChurchCRM to version 6.5.3 or later.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-66396

GHSA-WHPP-WX64-4QP9

Affected Products

Churchcrm

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66396.json · Exploit
• https://github.com/ChurchCRM/CRM/security/advisories/GHSA-whpp-wx64-4qp9 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-66396 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-66396 · Security Note
• https://twitter.com/CVEnew/status/2002835979715989874 · Twitter Post