PT-2026-30945 · Churchcrm · Churchcrm

Sh4Dowalker · Published 2026-04-07 · Updated 2026-04-07 · CVE-2026-39323

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ChurchCRM versions prior to 7.1.0

Description A critical SQL injection issue exists in ChurchCRM's PropertyTypeEditor.php. The Name and Description POST parameters are insufficiently sanitized using only strip tags() before being directly incorporated into SQL queries. This allows authenticated users with 'Manage Properties' permission to execute arbitrary SQL commands, potentially leading to data exfiltration, modification, and deletion. Injected data persists in the database and is reflected across multiple application pages without output encoding.

Recommendations Update to version 7.1.0 or later.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-39323

Affected Products

Churchcrm

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-39323 · Security Note
• https://github.com/ChurchCRM/CRM/security/advisories/GHSA-vmfg-c69g-m8p8 · Note
• https://twitter.com/CVEnew/status/2041603192236982518 · Twitter Post
• https://twitter.com/CveFindCom/status/2041587767524589938 · Twitter Post