PT-2025-6821 · Churchcrm · Churchcrm

Michael Mcinerney + 1 · Published 2025-02-18 · Updated 2025-07-13 · CVE-2025-1023

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ChurchCRM versions 5.13.0 and prior

Description A time-based blind SQL Injection vulnerability exists in the EditEventTypes functionality, allowing an attacker to execute arbitrary SQL queries. The newCountName parameter is directly concatenated into an SQL query without proper sanitization, enabling an attacker to manipulate database queries and execute arbitrary commands. This could potentially lead to data exfiltration, modification, or deletion.

Recommendations For ChurchCRM versions 5.13.0 and prior, as a temporary workaround, consider disabling the EditEventTypes functionality until a patch is available. Restrict access to the newCountName parameter in the affected functionality to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

LPE

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-1023

Affected Products

Churchcrm

References · 11

• 🔥 https://github.com/ChurchCRM/CRM/issues/7246 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-1023 · Security Note
• https://osv.dev/vulnerability/CVE-2025-1023 · Vendor Advisory
• https://twitter.com/cracbot/status/1893616881325752522 · Twitter Post
• https://t.me/cvedetector/18323 · Telegram Post
• https://twitter.com/CVEnew/status/1891787318756872651 · Twitter Post
• https://twitter.com/CveFindCom/status/1891790622668791944 · Twitter Post
• https://t.me/cvenotify/111604 · Telegram Post
• https://twitter.com/carrero/status/1944418203406381226 · Twitter Post
• https://t.me/latest_high_impact_cve/1844 · Telegram Post
• https://reddit.com/r/secops_solution/comments/1kwst3h/top_ubuntu_security_patches_you_shouldnt_ignore · Reddit Post