What is the CVSS score of CVE-2025-67751?

CVE-2025-67751 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of ChurchCRM are affected by CVE-2025-67751?

ChurchCRM deployments before 6.5.0 are exposed to a high-severity SQL injection that can let a user with event-management permissions compromise the backend database.. A patch is available.

Is there a public PoC exploit available for CVE-2025-67751?

Yes, a public proof-of-concept exploit is available for CVE-2025-67751. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2025-67751?

Within 24 hours, inventory all ChurchCRM instances, identify any version before 6.5.0, restrict isAddEvent privileges to only essential staff, and review EventEditor.php activity for signs of exploitation. Within 7 days, test and deploy the vendor-released patch, ChurchCRM 6.5.0, to all affected systems, prioritizing externally reachable or business-critical deployments, and rotate database credentials if suspicious activity is found. Within 30 days, verify all instances are on 6.5.0 or later, enforce least privilege for event-management roles, perform a database integrity review for unauthorized changes, and add ChurchCRM to routine patch and vulnerability monitoring.

ChurchCRM CVE-2025-67751

HIGH

SQL Injection (CWE-89)

2025-12-16 security-advisories@github.com

PHP SQLi Churchcrm

7.2

CVSS 3.1 · Vendor: github

Severity by source

Vendor (github) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable HTTP parameter (AV:N) with trivial injection (AC:L); isAddEvent is a granular non-admin permission so PR:L rather than PR:H; SQLi yields full DB C/I/A.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Oct 07, 2026 - 19:37 vuln.today

CVE Published

Dec 16, 2025 - 01:15 cve.org

HIGH 7.2

DescriptionCVE.org

ChurchCRM is an open-source church management system. Prior to version 6.5.0, a SQL injection vulnerability exists in the EventEditor.php file. When creating a new event and selecting an event type, the EN_tyid POST parameter is not sanitized. This allows an authenticated user with event management permissions (isAddEvent) to execute arbitrary SQL queries. Version 6.5.0 fixes the issue.

AnalysisAI

An authenticated SQL injection in ChurchCRM before 6.5.0 lets a user who holds the event-management permission (isAddEvent) execute arbitrary SQL by supplying a crafted EN_tyid parameter while creating or editing an event in EventEditor.php. Exploitation is gated by a valid login plus that specific capability rather than being reachable anonymously, but it yields full confidentiality, integrity, and availability impact on the backend database once triggered. Publicly available exploit code exists, and the flaw is fully remediated in ChurchCRM 6.5.0; there is no indication of confirmed active exploitation (not in CISA KEV).

Technical ContextAI

The defect is a classic CWE-89 SQL injection arising from string-concatenated SQL in PHP. In EventEditor.php the application built the query "SELECT * FROM event_types WHERE type_id=$tyid" and passed it straight to RunQuery()/mysqli, so the EN_tyid POST value was interpolated into the SQL text without parameterization or type casting. Because the injected value lands in a bare numeric context in the WHERE clause, an attacker can break out of the predicate and append arbitrary SQL (e.g. UNION/boolean/stacked statements), enabling read and modification of any table the ChurchCRM database user can reach - including members, donations, families, and user/credential tables. ChurchCRM is an open-source PHP/MySQL church management system, and the CPE cpe:2.3:a:churchcrm:churchcrm:*:*:*:*:*:*:*:* applies to all releases below the fixed build. The vendor fix (commit 2d6cf7aed9af1b9b47e125d1a2266f8e2a88f3fd) removes the raw string SQL entirely and replaces it with the Propel ORM (EventTypeQuery::create()->findById((int)$tyid) and EventCountNamesQuery), which both parameterizes the query and casts the identifier to an integer. The same commit hardens several sibling code paths (FamilyCustomFieldsEditor.php, PersonCustomFieldsEditor.php, SystemSettings.php) that used similar raw-SQL concatenation and a password-default disclosure issue, indicating a broader pattern of unsafe query construction in this codebase.

RemediationAI

Upgrade to ChurchCRM 6.5.0, which is the vendor-released patch that fixes this issue; the corresponding upstream fix is commit 2d6cf7aed9af1b9b47e125d1a2266f8e2a88f3fd and the tracking advisory is GHSA-wxcc-gvfv-56fg at https://github.com/ChurchCRM/CRM/security/advisories/GHSA-wxcc-gvfv-56fg. If an immediate upgrade is not possible, treat the affected code as unsafe and apply compensating controls with their trade-offs understood: (1) revoke the isAddEvent capability from all but the smallest, most trusted set of accounts, since exploitation requires that permission - this closes the practical attack path but blocks legitimate event managers from creating events; (2) apply a WAF or reverse-proxy rule that rejects or normalizes EN_tyid values which are not purely numeric on requests to EventEditor.php, which stops the common payload forms but can be bypassed and may break legitimate submissions if the rule is too strict; and (3) constrain the ChurchCRM database account to the least privileges it needs (no DDL, no FILE, no access to unrelated schemas), which limits how far an injected statement can reach but does not prevent data disclosure from the application's own tables. Because publicly available exploit code exists, prioritize any internet-facing or multi-tenant deployment for patching first, and review database and web logs for anomalous EventEditor.php requests or unexpected SQL in POST bodies as a detection measure.