PT-2025-51926 · Churchcrm · Churchcrm

Guilhermemury · Published 2025-12-17 · Updated 2025-12-20 · CVE-2025-67877

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ChurchCRM versions prior to 6.5.3

Description ChurchCRM, an open-source church management system, contains a SQL injection issue. The vulnerability resides in the src/CartToFamily.php file, specifically in the handling of the PersonAddress POST parameter. The PersonAddress parameter lacks proper type casting, unlike other parameters in the same file, allowing for the injection of arbitrary SQL commands.

Recommendations Update to version 6.5.3 or later.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-67877

GHSA-H3VQ-9GR6-H9R4

Affected Products

Churchcrm

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/67xxx/CVE-2025-67877.json · Exploit
• 🔥 https://github.com/ChurchCRM/CRM/security/advisories/GHSA-h3vq-9gr6-h9r4 · Exploit
• https://osv.dev/vulnerability/CVE-2025-67877 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-67877 · Security Note
• https://t.me/cveNotify/146236 · Telegram Post
• https://twitter.com/CVEnew/status/2002487820167049393 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2001462571421831285 · Twitter Post