High · published December 17, 2025
⚡ An SQL injection vulnerability lurking in ChurchCRM can let any authenticated user issue arbitrary SQL commands! 🔥 Think of it like a restaurant where the chef follows any order without question, even when a customer asks for a dish that could wreck the entire menu. In this case, an attacker can exploit the unchecked `WhichType` parameter to serve up malicious SQL queries that could change, exfiltrate, or even delete sensitive data. This vulnerability can turn friendly events into a data disaster! An attacker could access, modify, or wipe out sensitive information – think user credentials, financial records, and personal details. The consequences could be absolutely devastating, leading to a full compromise of the application's database.
Think of it like a restaurant where the chef follows any order without question, even when a customer asks for a dish that could wreck the entire menu. In this case, an attacker can exploit the unchecked `WhichType` parameter to serve up malicious SQL queries that could change, exfiltrate, or even delete sensitive data. In versions prior to 6.5.3, ChurchCRM's `src/ListEvents.php` file does not adequately sanitize the `WhichType` POST parameter, making it vulnerable to SQL injection attacks that authenticated users can exploit, even if they have low privilege levels.
This vulnerability can turn friendly events into a data disaster! An attacker could access, modify, or wipe out sensitive information – think user credentials, financial records, and personal details. The consequences could be absolutely devastating, leading to a full compromise of the application's database. Update ChurchCRM to version 6.5.3 immediately to close this vulnerability. Additionally, review your SQL queries to ensure proper parameterization and sanitization practices are enforced. Don't forget to audit user roles and permissions! You've got this! With these steps, you’ll be one step closer to securing your application. 🛡️