Church Donation System
CVE-2025-7859
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify vulnerable endpoint
-
DeliverySend POST with SQLi payload in new_password
-
ExploitUnsanitized input executed as SQL
-
ExecutionAttacker modifies data or extracts credentials
-
ImpactImpact: password compromise or data breach
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Input neutralization, injection prevention
|
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of Church Donation System 1.0. The only limiting factor is that the attacker must have network access to the vulnerable endpoint. No user interaction or authentication required. |
| Impact | CVSS 4.0 vector indicates network-based, low-complexity, unauthenticated exploitation with low impacts on confidentiality, integrity, and availability. The availability of a public exploit raises the immediate risk for any exposed instance, but the low EPSS score (0.07%, percentile 20) suggests limited active exploitation. No CISA KEV listing indicates no confirmed mass exploitation. SSVC decision: exploitation status is 'Public PoC', automatable (yes, simple injection), technical impact moderate (1 of 3). Risk is medium for unpatched systems, but low overall due to the niche product footprint. |
| Exploit ScenarioDerived | An attacker sends an HTTP request to /members/update_password_admin.php with a crafted payload in the new_password POST parameter, such as ' OR '1'='1' -- to bypass authentication or modify the admin password. A public proof-of-concept is available from the GitHub issue link. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 27, 2026
SQL injection in code-projects Church Donation System 1.0 allows unauthenticated remote attackers to manipulate the new_password parameter in /members/update_password_admin.php, enabling arbitrary SQL execution that can modify admin passwords or extract data. A public exploit is available, though EPSS (0.07%) suggests low exploitation probability in the wild.
RemediationAI
No vendor-released patch identified at time of analysis. As a workaround, implement strict input validation or parameterized queries for the new_password field in /members/update_password_admin.php. Disable the endpoint or restrict access via .htaccess or web server rules if not needed. Deploy a Web Application Firewall (WAF) with SQL injection signatures. These mitigations may break legitimate password change functionality.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This is a classic SQL injection vulnerability (CWE-74) in a PHP-based web application. The vulnerable endpoint /members/update_password_admin.php accepts user-controlled input via the new_password argument without proper sanitization or parameterized queries, allowing an attacker to inject malicious SQL commands. Affected product is Church Donation System 1.0 (CPE: cpe:2.3:a:carmelo:church_donation_system:1.0). The application likely uses a MySQL backend, making it susceptible to standard SQL injection techniques.
Know when Church Donation System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Remote unauthenticated SQL injection with low impact on all CIA.
Primary rating from NVD.
CVSS VectorNVD
DescriptionCVE.org
A vulnerability classified as critical was found in code-projects Church Donation System 1.0. This vulnerability affects unknown code of the file /members/update_password_admin.php. The manipulation of the argument new_password leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Affected Products (CPE)CVE.org
More in Church Donation System
View allRemote unrestricted file upload in code-projects Church Donation System 1.0 allows unauthenticated attackers to upload a
SQL injection in Church Donation System 1.0 allows remote unauthenticated attackers to execute arbitrary SQL queries via
SQL injection in code-projects Church Donation System 1.0 allows remote attackers to manipulate database queries via the
SQL injection in Church Donation System 1.0 allows remote attackers to manipulate the database by injecting SQL commands
SQL injection in code-projects Church Donation System 1.0 allows remote attackers to manipulate database queries via the
SQL injection in code-projects Church Donation System 1.0 enables unauthenticated remote attackers to read or modify dat
SQL injection in code-projects Church Donation System 1.0 allows remote attackers to manipulate database queries via the
SQL injection in Church Donation System 1.0 allows remote attackers to manipulate the Amount parameter in /members/givin
SQL injection in Church Donation System 1.0 allows remote attackers to execute arbitrary SQL commands via the trcode par
SQL injection in Church Donation System 1.0 enables remote attackers to execute arbitrary SQL commands via the trcode pa
We are tasked with synthesizing a CVE analysis for CVE-2025-7830. We must output a JSON object with specific fields. Le
SQL injection in code-projects Church Donation System 1.0 allows remote attackers to manipulate database queries via the
Exploit-DB