What is the CVSS score of CVE-2026-35566?

CVE-2026-35566 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Which versions of PHP are affected by CVE-2026-35566?

ChurchCRM versions before 7.1.0 contain a SQL injection vulnerability in the fundraiser reporting module that allows low-privilege authenticated users to execute arbitrary database commands, risking…. A patch is available.

How to fix or mitigate CVE-2026-35566?

Within 24 hours: Identify all ChurchCRM instances in your environment and document current version numbers. Within 7 days: Upgrade all ChurchCRM installations to version 7.1.0 or later, and validate the upgrade in a test environment first. Within 30 days: Review database access logs for suspicious SQL activity, audit user permissions to the fundraiser statement report functionality, and implement application-level SQL query monitoring.

PHP CVE-2026-35566

EUVD-2026-19720 HIGH

SQL Injection (CWE-89)

2026-04-07 GitHub_M

SQLi PHP Crm

8.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:04 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

7.1.0

EUVD ID Assigned

Apr 07, 2026 - 16:00 euvd

EUVD-2026-19720

Analysis Generated

Apr 07, 2026 - 16:00 vuln.today

CVE Published

Apr 07, 2026 - 15:48 nvd

HIGH 8.8

DescriptionGitHub Advisory

ChurchCRM is an open-source church management system. Prior to 7.1.0, a critical SQL injection vulnerability exists in src/Reports/FundRaiserStatement.php where the $_SESSION['iCurrentFundraiser'] value is used in an unquoted numeric SQL context without integer validation. The value originates from src/FundRaiserEditor.php where InputUtils::legacyFilterInputArr() is called without the 'int' type specifier. This vulnerability is fixed in 7.1.0.

AnalysisAI

SQL injection in ChurchCRM versions prior to 7.1.0 allows authenticated users with low privileges to execute arbitrary SQL commands via the fund raiser statement report functionality. The vulnerability stems from inadequate input validation of session-based fundraiser identifiers in src/Reports/FundRaiserStatement.php, enabling attackers to achieve complete database compromise including data exfiltration, modification, and potential remote code execution. EPSS exploitation probability and KEV status unavailable, but public advisory exists from GitHub Security (GHSA-grq6-q49f-44xh). No public exploit identified at time of analysis, though SQL injection exploits are well-documented and exploitation complexity is low per CVSS vector (AC:L).

Technical ContextAI

This vulnerability affects ChurchCRM (cpe:2.3:a:churchcrm:crm), a PHP-based open-source church management system. The root cause is CWE-89 (SQL Injection) resulting from unsafe handling of the $_SESSION['iCurrentFundraiser'] session variable. The attack chain begins in src/FundRaiserEditor.php where InputUtils::legacyFilterInputArr() sanitizes user input without specifying the 'int' type parameter, allowing non-numeric values to pass validation. The tainted session variable is then consumed in src/Reports/FundRaiserStatement.php within an unquoted numeric SQL context, enabling SQL metacharacter injection. This represents a classic second-order SQL injection where the malicious payload persists in session state before triggering during report generation. The vulnerability demonstrates the danger of relying on session variables as trusted input without re-validation at consumption points.

RemediationAI

Upgrade immediately to ChurchCRM version 7.1.0 or later, which contains vendor-released patches addressing the SQL injection vulnerability in the fund raiser statement reporting functionality. The fix implements proper integer type validation for the $_SESSION['iCurrentFundraiser'] variable using the 'int' type specifier in InputUtils::legacyFilterInputArr() and employs parameterized queries or proper escaping in SQL construction. Organizations unable to upgrade immediately should implement compensating controls including restricting access to the fund raiser report functionality to only highly trusted administrative users, implementing web application firewall rules to detect SQL injection patterns in requests to affected endpoints, and enabling comprehensive SQL query logging to detect exploitation attempts. Review application logs for suspicious activity in FundRaiserStatement.php access patterns. Consult the official GitHub Security Advisory at https://github.com/ChurchCRM/CRM/security/advisories/GHSA-grq6-q49f-44xh for complete remediation guidance and additional security recommendations from the ChurchCRM development team.