PT-2025-7493 · Churchcrm · Churchcrm

Michael Mcinerney + 1 · Published 2025-02-19 · Updated 2025-02-19 · CVE-2025-1133

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:L/SA:H/AU:Y/R:U/V:C/RE:H/U:Red

Name of the Vulnerable Software and Affected Versions ChurchCRM versions 5.13.0 and prior

Description A boolean-based blind SQL Injection vulnerability exists in the EditEventAttendees functionality, allowing an attacker to execute arbitrary SQL queries. The EID parameter is directly concatenated into an SQL query without proper sanitization, making it susceptible to SQL injection attacks. An attacker can manipulate the query, potentially leading to data exfiltration, modification, or deletion. This issue requires Administrator privileges.

Recommendations For ChurchCRM versions 5.13.0 and prior, as a temporary workaround, consider disabling the EditEventAttendees functionality until a patch is available. Restrict access to the EID parameter to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-1133

Affected Products

Churchcrm

References · 10

• 🔥 https://github.com/ChurchCRM/CRM/issues/7252 · Exploit
• https://osv.dev/vulnerability/CVE-2025-1133 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-1133 · Security Note
• https://twitter.com/CveFindCom/status/1892137650263298327 · Twitter Post
• https://t.me/cvenotify/111750 · Telegram Post
• https://twitter.com/CVEnew/status/1892140872248295588 · Twitter Post
• https://t.me/cvedetector/18417 · Telegram Post
• https://t.me/latest_high_impact_cve/1852 · Telegram Post
• https://t.me/thedarkwebinformer/12919 · Telegram Post
• https://twitter.com/DarkWebInformer/status/1892252970667962599 · Twitter Post