Critical · published February 18, 2025
🚨 ChurchCRM's EditEventTypes functionality has a time-based blind SQL Injection vulnerability that could let attackers execute arbitrary SQL queries with alarming ease! 🔥 Think of it like an unsuspecting librarian who, without checking, lets anyone request changes to the entire catalog just by mentioning a book title — that's how this SQL vulnerability operates! If exploited, an attacker could perform a wide range of malicious actions, from exfiltrating sensitive data to modifying or even deleting critical information. It’s an open invitation to a data disaster that could compromise the entire database!
Think of it like an unsuspecting librarian who, without checking, lets anyone request changes to the entire catalog just by mentioning a book title — that's how this SQL vulnerability operates! In ChurchCRM v5.13.0 and prior, the newCountName parameter is directly included in an SQL query without proper sanitization, making it possible for attackers to manipulate queries and execute arbitrary commands.
If exploited, an attacker could perform a wide range of malicious actions, from exfiltrating sensitive data to modifying or even deleting critical information. It’s an open invitation to a data disaster that could compromise the entire database! Update ChurchCRM to version 5.13.1 or later to patch this vulnerability immediately. Additionally, review and sanitize all inputs used in SQL queries to prevent similar exploits. Committing to secure coding practices will greatly reduce risks. You've got this! Follow these steps, and you'll lock down your application in no time! 🛡️