Which versions of PHP are affected by CVE-2026-35184?

EcclesiaCRM versions prior to 8.0.0 contain a SQL injection vulnerability in the query interface that allows authenticated users with low privileges to execute arbitrary database commands,…. A patch is available.

How to fix or mitigate CVE-2026-35184?

Within 24 hours: Audit current EcclesiaCRM deployment to identify installed version (check application interface or installation files). Within 7 days: Upgrade to EcclesiaCRM 8.0.0 or later; coordinate with CRM administrator and test upgrade in non-production environment first. Within 30 days: Conduct access audit to review which user accounts have query interface permissions and reduce to principle of least privilege; implement Web Application Firewall (WAF) rules to block SQL injection patterns in query parameters as temporary layer during upgrade period.

PHP CVE-2026-35184

Q: What is the CVSS score of CVE-2026-35184?

CVE-2026-35184 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-19468 HIGH

SQL Injection (CWE-89)

2026-04-06 GitHub_M

SQLi PHP

8.7

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:05 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

8.0.0

Re-analysis Queued

Apr 16, 2026 - 04:50 vuln.today

cvss_changed

EUVD ID Assigned

Apr 06, 2026 - 19:45 euvd

EUVD-2026-19468

Analysis Generated

Apr 06, 2026 - 19:45 vuln.today

CVE Published

Apr 06, 2026 - 19:21 nvd

HIGH 8.7

DescriptionGitHub Advisory

EcclesiaCRM is CRM Software for church management. Prior to 8.0.0, there is a SQL injection vulnerability in v2/templates/query/queryview.php via the custom and value parameters. This vulnerability is fixed in 8.0.0.

AnalysisAI

SQL injection in EcclesiaCRM v2/templates/query/queryview.php allows authenticated remote attackers to execute arbitrary SQL commands via unsanitized 'custom' and 'value' parameters. All versions prior to 8.0.0 are affected. CVSS 8.7 (High) with network vector, low complexity, and low privileges required. Publicly available exploit code exists (detailed PoC published in referenced Gist). EPSS data not provided, but the combination of public PoC, clear attack path, and critical CWE-89 classification elevates real-world exploitation risk. No confirmed active exploitation (CISA KEV) at time of analysis.

Technical ContextAI

This vulnerability affects EcclesiaCRM, a PHP-based church management CRM system (CPE: cpe:2.3:a:phili67:ecclesiacrm). The flaw exists in the query view template component (v2/templates/query/queryview.php), which processes user-supplied input for database queries without proper sanitization or parameterization. CWE-89 (SQL Injection) occurs when untrusted data is incorporated directly into SQL statements, allowing attackers to manipulate query logic. The affected parameters ('custom' and 'value') appear to be used in dynamic query construction, enabling injection of malicious SQL syntax. CVSS:4.0 vector indicates network-based attack with low complexity and no user interaction required, though low-level authentication (PR:L) is necessary, suggesting exploitation requires valid user credentials to the application.

RemediationAI

Vendor-released patch: upgrade to EcclesiaCRM version 8.0.0 or later, which contains the security fix committed in f743b97f89da469a4c70b82bd61d0a59a3a957a9. The remediation is implemented in GitHub pull request #2861 (https://github.com/phili67/ecclesiacrm/pull/2861) and merged into the 8.0.0 release. Organizations running affected versions should immediately upgrade to 8.0.0 following the vendor's standard upgrade procedures. Review the official security advisory at https://github.com/phili67/ecclesiacrm/security/advisories/GHSA-gjw3-73q9-v2qh for additional context and upgrade guidance. If immediate patching is not feasible, implement temporary compensating controls such as restricting access to the query view functionality to highly trusted administrators only, implementing web application firewall (WAF) rules to detect SQL injection patterns in the 'custom' and 'value' parameters, and monitoring database query logs for anomalous SQL statements. However, these workarounds are not substitutes for applying the vendor patch.