PT-2025-51929 · Churchcrm · Churchcrm

Xy20130630 · Published 2025-12-17 · Updated 2025-12-20 · CVE-2025-68111

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ChurchCRM versions prior to 6.5.3

Description ChurchCRM is an open-source church management system. A SQL injection issue exists in the eGive.php file within the "ReImport" functionality. An authenticated user with finance privileges can execute arbitrary SQL queries by manipulating the MissingEgive FamID ... POST parameter. This can lead to unauthorized data access, modification, or deletion within the database.

Recommendations Update to version 6.5.3 or later.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-68111

GHSA-C4VM-87VF-HMX9

Affected Products

Churchcrm

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68111.json · Exploit
• https://github.com/ChurchCRM/CRM/security/advisories/GHSA-c4vm-87vf-hmx9 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-68111 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-68111 · Security Note
• https://twitter.com/CVEnew/status/2002487817272963400 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2001460011495575978 · Twitter Post