Critical · published December 17, 2025
🚨 An exposed SQL injection endpoint is still hanging around in ChurchCRM! Any authenticated user can exploit this legacy code and access sensitive data without proper permissions. 🔥 Think of it like finding a hidden door in a building that was supposed to be closed off — the door is gone from the floor plan, but if you know where it is, you can still open it and step inside into the vault! With this vulnerability, an attacker could manipulate the `familyId` parameter and execute arbitrary SQL commands. This could lead to unauthorized data exposure, deletion, or even a complete takeover of the database — a nightmare scenario for any church organization! 🎭
Think of it like finding a hidden door in a building that was supposed to be closed off — the door is gone from the floor plan, but if you know where it is, you can still open it and step inside into the vault! The SQL injection flaw resides in the legacy endpoint `/Reports/ConfirmReportEmail.php`, which allows attackers to inject malicious SQL queries through a parameter that should not be accessible, especially to users with limited permissions.
With this vulnerability, an attacker could manipulate the `familyId` parameter and execute arbitrary SQL commands. This could lead to unauthorized data exposure, deletion, or even a complete takeover of the database — a nightmare scenario for any church organization! 🎭 To secure your ChurchCRM installation, upgrade to version 6.5.3 or later immediately. Additionally, review your application for any other dead code that might pose risks and consider limiting access permissions for authenticated users. 🛡️ You've got this! Fixing this issue is straightforward with the right upgrade. Let’s keep your system secure! 💪😊