PT-2026-30945 · Churchcrm · Crm

Published 2026-04-07 · Updated 2026-04-07 · CVE-2026-39323

NVD

CVSS v3.1

8.8

High

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

ChurchCRM is an open-source church management system. Prior to 7.1.0, a critical SQL injection vulnerability exists in ChurchCRM's PropertyTypeEditor.php where the Name and Description POST parameters are sanitized only with strip tags() before direct concatenation into SQL queries. This allows authenticated users with "Manage Properties" permission to execute arbitrary SQL commands including data exfiltration, modification, and deletion. Injected data persists in the database and is reflected across multiple application pages without output encoding. This vulnerability is fixed in 7.1.0.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-39323

Affected Products

Crm

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-39323 · Security Note
• https://github.com/ChurchCRM/CRM/security/advisories/GHSA-vmfg-c69g-m8p8 · Note