High · published January 30, 2026
⚡ An SQL Injection vulnerability lurks in ChurchCRM that anyone with a login can exploit! 🚨 Imagine a user with no permissions being handed the keys to the database vault just because of a crafty URL parameter. Think of it like a restaurant where anyone with a reservation can walk into the kitchen and start changing the menu, even if they only booked a table for two. That’s what’s happening here with the `PerID` parameter – it lets unauthorized changes slip right in through the back door! An attacker could leverage this vulnerability to manipulate the database, leading to unauthorized access to sensitive information, data corruption, or even complete system compromise. With the potential for such devastating consequences, it's crucial to address this issue immediately!
Think of it like a restaurant where anyone with a reservation can walk into the kitchen and start changing the menu, even if they only booked a table for two. That’s what’s happening here with the `PerID` parameter – it lets unauthorized changes slip right in through the back door! This SQL Injection vulnerability in ChurchCRM's `/PaddleNumEditor.php` endpoint allows authenticated users, regardless of their permission levels, to inject malicious SQL code through the `PerID` parameter, enabling unauthorized actions on the database.
An attacker could leverage this vulnerability to manipulate the database, leading to unauthorized access to sensitive information, data corruption, or even complete system compromise. With the potential for such devastating consequences, it's crucial to address this issue immediately! Upgrade ChurchCRM to version 6.7.2 to patch this vulnerability immediately. Additionally, review user permissions and consider implementing input validation to safeguard against SQL Injection attacks in the future—it's a win-win for security! You've got this! Follow these steps, and you’ll be a security hero in no time! 🛡️