What is the CVSS score of CVE-2026-39323?

CVE-2026-39323 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-39323?

ChurchCRM versions prior to 7.1.0 contain a SQL injection vulnerability in the PropertyTypeEditor component that allows authenticated users with 'Manage Properties' permissions to execute arbitrary…. A patch is available.

How to fix or mitigate CVE-2026-39323?

Within 24 hours: Identify all ChurchCRM installations and document current versions. Within 7 days: Upgrade ChurchCRM to version 7.1.0 or later on all affected instances; test property management functionality post-upgrade. Within 30 days: Review and restrict 'Manage Properties' permissions to only essential administrative users; audit database access logs for suspicious SQL activity in the timeframe prior to patching.

PHP CVE-2026-39323

EUVD-2026-19809 HIGH

SQL Injection (CWE-89)

2026-04-07 GitHub_M

PHP SQLi

8.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:03 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

7.1.0

EUVD ID Assigned

Apr 07, 2026 - 18:00 euvd

EUVD-2026-19809

Analysis Generated

Apr 07, 2026 - 18:00 vuln.today

CVE Published

Apr 07, 2026 - 17:28 nvd

HIGH 8.8

DescriptionGitHub Advisory

ChurchCRM is an open-source church management system. Prior to 7.1.0, a critical SQL injection vulnerability exists in ChurchCRM's PropertyTypeEditor.php where the Name and Description POST parameters are sanitized only with strip_tags() before direct concatenation into SQL queries. This allows authenticated users with "Manage Properties" permission to execute arbitrary SQL commands including data exfiltration, modification, and deletion. Injected data persists in the database and is reflected across multiple application pages without output encoding. This vulnerability is fixed in 7.1.0.

AnalysisAI

SQL injection in ChurchCRM's PropertyTypeEditor.php allows authenticated users with 'Manage Properties' permission to execute arbitrary SQL commands through unsanitized Name and Description POST parameters. ChurchCRM versions prior to 7.1.0 are affected. The vulnerability relies on inadequate input validation (strip_tags() only) before SQL concatenation, enabling data exfiltration, modification, and deletion. CVSS 8.8 reflects high impact across confidentiality, integrity, and availability. No public exploit identified at time of analysis, though the attack vector is network-accessible with low complexity once authenticated. EPSS data not provided, but the requirement for authenticated access with specific permissions reduces immediate exploitation surface compared to unauthenticated vulnerabilities.

Technical ContextAI

This vulnerability stems from classic SQL injection (CWE-89) in ChurchCRM, a PHP-based church management system. The PropertyTypeEditor.php component accepts Name and Description parameters via POST requests and applies only strip_tags() for sanitization-a function designed to remove HTML/PHP tags, not prevent SQL injection. These insufficiently sanitized inputs are directly concatenated into SQL queries rather than using parameterized statements or prepared queries. The injected payloads persist in the database and are reflected across multiple application pages without proper output encoding, creating both immediate SQL execution risks and stored cross-site scripting potential. The CPE identifier (cpe:2.3:a:churchcrm:crm) confirms this affects the ChurchCRM core application. Exploitation requires authentication with 'Manage Properties' permission, indicating the vulnerability targets administrative or privileged user functions rather than public-facing endpoints.

RemediationAI

Upgrade to ChurchCRM version 7.1.0 or later, which addresses this SQL injection vulnerability through proper input validation and parameterized queries. The vendor-released patch eliminates direct SQL concatenation in PropertyTypeEditor.php and implements secure coding practices for database interactions. Organizations should download version 7.1.0 from the official ChurchCRM GitHub repository and follow standard upgrade procedures including database backups before migration. As an interim mitigation for environments unable to immediately upgrade, restrict 'Manage Properties' permission to only essential trusted administrators and monitor database query logs for suspicious patterns including SQL metacharacters in property names or descriptions. Audit existing property records for signs of injection attempts. Review the vendor security advisory at https://github.com/ChurchCRM/CRM/security/advisories/GHSA-vmfg-c69g-m8p8 for additional technical details and upgrade guidance.