PT-2025-7492 · Churchcrm · Churchcrm

Michael Mcinerney

+1

·

Published

2025-02-19

·

Updated

2025-02-25

·

CVE-2025-1132

CVSS v4.0

9.3

Critical

VectorAV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:L/SA:H/AU:Y/R:U/V:C/RE:H/U:Red
Name of the Vulnerable Software and Affected Versions ChurchCRM versions 5.13.0 and prior
Description A time-based blind SQL Injection vulnerability exists in the EditEventAttendees.php file within the EN tyid parameter. The parameter is directly inserted into an SQL query without proper sanitization, allowing attackers to inject malicious SQL commands. This flaw can potentially allow attackers to delay the response, indicating the presence of an SQL injection vulnerability. While it is a time-based blind injection, it can be exploited to gain insights into the underlying database, and with further exploitation, sensitive data could be retrieved. The vulnerability requires Administrator permissions.
Recommendations For ChurchCRM versions 5.13.0 and prior, as a temporary workaround, consider restricting access to the EditEventAttendees.php file and the EN tyid parameter to minimize the risk of exploitation. Avoid using the EN tyid parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

CVE-2025-1132

Affected Products

Churchcrm