PT-2026-30963 · Churchcrm · Churchcrm

Curly-Haired-Baboon · CVE-2026-39340 · Published 2026-04-07 · Updated 2026-04-07

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions ChurchCRM versions prior to 7.1.0

Description ChurchCRM, an open-source church management system, contains a SQL injection issue in the PropertyTypeEditor.php file, which is part of the administration functionality for managing property type categories (People → Person Properties / Family Properties). The issue arises from replacing the legacyFilterInput() function, which both strips HTML and escapes SQL, with sanitizeText(), which only strips HTML. This allows authenticated users with the MenuOptions role to perform time-based blind injection and potentially access all data within the database, including password hashes.

Recommendations Update to version 7.1.0 or later.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-39340

GHSA-66F7-4P96-MWW9

Affected Products

Churchcrm

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39340.json · Exploit
• 🔥 https://github.com/ChurchCRM/CRM/security/advisories/GHSA-66f7-4p96-mww9 · Exploit
• https://osv.dev/vulnerability/CVE-2026-39340 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-39340 · Security Note
• https://twitter.com/CVEnew/status/2041603174562160912 · Twitter Post