High · published December 16, 2025
⚡ An SQL injection vulnerability lurks in ChurchCRM, affecting users with event management permissions—it's a sneak-in-the-back-door kind of flaw! Think of it like a caterer who, instead of cooking your meal, takes the shortcut of just ordering food from anywhere without checking its quality. This vulnerability allows an authenticated user to craft their own SQL queries, bypassing the intended safeguards and potentially wreaking havoc. An attacker could exploit this to execute arbitrary SQL commands within the database. This could lead to unauthorized access to sensitive data, manipulation of event records, or even complete data loss—devastating for a church's event planning!
Think of it like a caterer who, instead of cooking your meal, takes the shortcut of just ordering food from anywhere without checking its quality. This vulnerability allows an authenticated user to craft their own SQL queries, bypassing the intended safeguards and potentially wreaking havoc. This SQL injection vulnerability allows authenticated users with the right permissions to insert malicious SQL through the `EN_tyid` POST parameter in `EventEditor.php`, compromising the integrity of the database.
An attacker could exploit this to execute arbitrary SQL commands within the database. This could lead to unauthorized access to sensitive data, manipulation of event records, or even complete data loss—devastating for a church's event planning! Update ChurchCRM to version 6.5.0 to patch this vulnerability immediately. Additionally, review your event management permissions and ensure strict input validation is enforced to prevent future exploits. You've got this! Secure your system and safeguard your precious data with just a quick update! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| churchcrm/churchcrm | < 6.5.0 | 6.5.0 |