Churchcrm CVE-2026-39342

Authenticated user with access to ChurchCRM Data/Reports > Query Menu and 'Advanced Search' query. Attacker exploits SQL injection via searchwhat parameter in QueryView.php with QueryID=15. Affects ChurchCRM versions prior to 7.1.0.

Real-world risk is HIGH despite authentication requirement. CVSS 4.0 vector shows AV:N (network attack vector), AC:L (low complexity), PR:L (low privileges required), with complete impact across all CIA triad metrics (VC:H/VI:H/VA:H) plus system-level impact (SC:H/SI:H/SA:H). The critical 9.4 score is justified by the ease of exploitation once authenticated and catastrophic potential impact. EPSS probability data not available for forward-dated CVE identifier. No CISA KEV listing indicates no confirmed active exploitation campaigns. Risk is elevated by: (1) network accessibility allowing remote exploitation, (2) SQL injection class being well-understood with readily available exploitation techniques, (3) authentication barrier being relatively low (basic user account with reporting access). Risk is partially mitigated by authentication requirement and need for specific module permissions, limiting attack surface to insider threats or compromised accounts. Organizations using ChurchCRM should prioritize patching given the trivial attack complexity and complete system compromise potential.

An attacker with valid credentials to a ChurchCRM installation navigates to the Data/Reports section and accesses the Query Menu with Advanced Search (QueryID=15). By crafting malicious SQL syntax in the searchwhat parameter submitted to QueryView.php, the attacker executes arbitrary database queries. This enables complete extraction of sensitive church member data including names, addresses, donation records, and credentials, modification of financial records, deletion of database tables, or creation of administrative backdoor accounts for persistent access. Given the low attack complexity and network accessibility, compromised or malicious insider accounts represent the primary threat vector.