PT-2026-30944 · Churchcrm · Crm

Published 2026-04-07 · Updated 2026-04-07 · CVE-2026-39318

Mitre

CVSS v3.1

8.8

High

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

ChurchCRM is an open-source church management system. Prior to 7.1.0, the GroupPropsFormRowOps.php file contains a SQL injection vulnerability. User input in the Field parameter is directly inserted into SQL queries without proper sanitization. The mysqli real escape string() function does not escape backtick characters, allowing attackers to break out of SQL identifier context and execute arbitrary SQL statements. This vulnerability is fixed in 7.1.0.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-39318

Affected Products

Crm

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-39318 · Security Note
• https://github.com/ChurchCRM/CRM/security/advisories/GHSA-j3vj-59vv-h4rc · Note