What is the CVSS score of CVE-2026-39340?

CVE-2026-39340 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-39340?

ChurchCRM contains a SQL injection vulnerability in property type management that allows staff-level users with MenuOptions permissions to extract sensitive database contents, including password…. A patch is available.

How to fix or mitigate CVE-2026-39340?

Within 24 hours: Identify ChurchCRM deployments and current version in your environment. Within 7 days: Apply the vendor-released patch to all ChurchCRM instances; restrict MenuOptions role permissions to administrative personnel only as interim control. Within 30 days: Conduct database audit for suspicious queries on PropertyTypeEditor.php logs; rotate database credentials and review user access logs for unauthorized data exfiltration.

PHP CVE-2026-39340

EUVD-2026-19841 HIGH

SQL Injection (CWE-89)

2026-04-07 security-advisories@github.com

PHP SQLi

8.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:03 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

7.1.0

EUVD ID Assigned

Apr 07, 2026 - 18:22 euvd

EUVD-2026-19841

Analysis Generated

Apr 07, 2026 - 18:22 vuln.today

CVE Published

Apr 07, 2026 - 18:16 nvd

HIGH 8.1

DescriptionGitHub Advisory

ChurchCRM is an open-source church management system. Prior to 7.1.0, a SQL injection vulnerability exists in PropertyTypeEditor.php, part of the administration functionality for managing property type categories (People → Person Properties / Family Properties). The vulnerability was introduced when legacyFilterInput() which both strips HTML and escapes SQL - was replaced with sanitizeText(), which strips HTML only. User-supplied values from the Name and Description fields are concatenated directly into raw INSERT and UPDATE queries with no SQL escaping. This allows any authenticated user with the MenuOptions role (a non-admin staff permission) to perform time-based blind injection and exfiltrate any data from the database, including password hashes of all users. This vulnerability is fixed in 7.1.0.

AnalysisAI

SQL injection in ChurchCRM's PropertyTypeEditor.php allows authenticated users with MenuOptions role permission to exfiltrate database contents including password hashes. The vulnerability stems from replacing SQL-escaping function legacyFilterInput() with sanitizeText() which only strips HTML, leaving Name and Description fields in property type management vulnerable to time-based blind injection. CVSS 8.1 reflects high confidentiality and integrity impact with low attack complexity from network-accessible authenticated attackers. No public exploit identified at time of analysis, though exploitation requires only basic staff-level permissions rather than administrative access.

Technical ContextAI

ChurchCRM is a PHP-based church management system providing member, donation, and property management features. This vulnerability affects the property type editor within the administrative interface at PropertyTypeEditor.php, specifically in the People → Person Properties / Family Properties management workflow. The root cause (CWE-89: SQL Injection) resulted from a code change that removed SQL parameterization protections. The legacy function legacyFilterInput() provided dual protection through HTML sanitization and SQL escaping, but was replaced with sanitizeText() which only performs HTML stripping via regex or strip_tags. User input from Name and Description form fields is then concatenated directly into raw INSERT and UPDATE SQL statements without prepared statements or mysql_real_escape_string equivalents. This creates a classic second-order SQL injection vector where malicious SQL syntax in property type metadata is executed during database write operations. The time-based blind injection technique mentioned suggests attackers can use SQL sleep functions to infer data bit-by-bit when direct error messages or data extraction are not available.

RemediationAI

Upgrade immediately to ChurchCRM version 7.1.0 or later, which contains a complete fix for the SQL injection vulnerability in PropertyTypeEditor.php according to the vendor security advisory. The patch restores proper SQL escaping for Name and Description field inputs during property type INSERT and UPDATE operations. Download the patched release from the official ChurchCRM GitHub repository at https://github.com/ChurchCRM/CRM/releases and follow standard upgrade procedures including database backup prior to applying version updates. If immediate patching is not feasible, implement temporary compensating controls by restricting MenuOptions role assignment to only highly trusted administrators and monitoring database query logs for suspicious SLEEP(), BENCHMARK(), or WAITFOR patterns indicative of time-based blind injection attempts. Review existing property type entries in the database for anomalous SQL syntax in name and description fields that may indicate prior exploitation. After upgrading, force password resets for all administrative users as a precautionary measure given the potential for credential hash exfiltration during the vulnerability window. Consult the GitHub security advisory at https://github.com/ChurchCRM/CRM/security/advisories/GHSA-66f7-4p96-mww9 for additional vendor guidance and confirmation of fix completeness.