What is the CVSS score of CVE-2026-34402?

CVE-2026-34402 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-34402?

ChurchCRM versions before 7.1.0 contain a SQL injection vulnerability in the PropertyAssign.php endpoint that allows authenticated users with basic permissions to exfiltrate or modify sensitive…. A patch is available.

How to fix or mitigate CVE-2026-34402?

Within 24 hours: Identify all ChurchCRM deployments and document current versions. Within 7 days: Upgrade all ChurchCRM installations to version 7.1.0 or later. Within 30 days: Audit database access logs for unauthorized PropertyAssign.php requests and review user access permissions to restrict Edit Records and Manage Groups roles to essential personnel only.

PHP CVE-2026-34402

EUVD-2026-19345 HIGH

SQL Injection (CWE-89)

2026-04-06 GitHub_M

SQLi PHP

8.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:06 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

7.1.0

EUVD ID Assigned

Apr 06, 2026 - 16:00 euvd

EUVD-2026-19345

Analysis Generated

Apr 06, 2026 - 16:00 vuln.today

CVE Published

Apr 06, 2026 - 15:27 nvd

HIGH 8.1

DescriptionGitHub Advisory

ChurchCRM is an open-source church management system. Prior to 7.1.0, authenticated users with Edit Records or Manage Groups permissions can exploit a time-based blind SQL injection vulnerability in the PropertyAssign.php endpoint to exfiltrate or modify any database content, including user credentials, personal identifiable information (PII), and configuration secrets. This vulnerability is fixed in 7.1.0.

AnalysisAI

Time-based blind SQL injection in ChurchCRM versions prior to 7.1.0 allows authenticated users with Edit Records or Manage Groups permissions to exfiltrate or modify database content including credentials, PII, and configuration secrets via the PropertyAssign.php endpoint. Attack requires low-privilege authentication (PR:L) but enables high confidentiality and integrity impact through database manipulation. No public exploit identified at time of analysis, though EPSS data was not provided. CVSS 8.1 reflects network-accessible exploitation with low complexity requiring only basic user privileges.

Technical ContextAI

This vulnerability represents a classic CWE-89 SQL injection flaw in a PHP-based application. ChurchCRM is an open-source church management system built on PHP that manages member records, donations, groups, and other church administrative functions. The vulnerability resides in the PropertyAssign.php endpoint, which likely handles property or attribute assignment operations for church members or groups. Time-based blind SQL injection is particularly dangerous as it allows attackers to infer database content through timing responses even when direct error messages or data output is not available. By injecting carefully crafted SQL payloads with time delays (such as SLEEP() or WAITFOR functions), attackers can extract information bit-by-bit by measuring response times. The affected CPE (cpe:2.3:a:churchcrm:crm) indicates this impacts the core ChurchCRM application, and the requirement for Edit Records or Manage Groups permissions suggests the vulnerable code path is accessed through privileged administrative functions rather than public-facing interfaces.

RemediationAI

Organizations running ChurchCRM must upgrade to version 7.1.0 or later to remediate this SQL injection vulnerability. The vendor-released patch version 7.1.0 addresses the time-based blind SQL injection in PropertyAssign.php through proper input validation and parameterized query implementation. Download the patched release from the official ChurchCRM GitHub repository and follow standard upgrade procedures including database backups before migration. As an interim mitigation for environments unable to immediately upgrade, consider restricting Edit Records and Manage Groups permissions to only essential trusted administrators, implementing web application firewall rules to detect SQL injection patterns in requests to PropertyAssign.php, and enabling comprehensive query logging to detect exploitation attempts characterized by unusual timing delays. Review database access logs for any suspicious activity patterns from accounts with these permissions prior to patching. Consult the GitHub Security Advisory at https://github.com/ChurchCRM/CRM/security/advisories/GHSA-r57q-r5v3-v5h8 for additional vendor guidance and migration notes.