FinancialService CVE-2026-40482

Authenticated access with low-privileged user credentials is required (CVSS PR:L). Specifically, the attacker must have a valid ChurchCRM user account with permissions to access the financial services module and use the member scanning functionality that invokes the getMemberByScanString() method. This suggests the vulnerable feature is used for barcode scanning or manual lookup of member financial records by routing and account number. No special configuration, non-default settings, or user interaction beyond the attacker's own actions is necessary (CVSS AC:L/UI:N). The vulnerability is exploitable against default ChurchCRM installations running versions prior to 7.2.0 where the financial module is enabled. Exploitation is limited by the requirement for authenticated access, meaning attackers must first obtain valid credentials through phishing, credential stuffing, insider threat, or exploitation of a separate authentication bypass vulnerability. The network attack vector (AV:N) means remote exploitation is possible without physical or local access to the server. No privilege escalation within the application is required beyond the baseline authenticated user role with financial module access.

Real-world risk is moderate to high for ChurchCRM deployments, driven by technical simplicity and sensitive data exposure potential, but tempered by authentication requirements. CVSS 7.1 (High severity) accurately reflects the technical impact-SQL injection with database read/write capabilities is always serious-but the PR:L (low-privileged authentication required) reduces the attack surface compared to unauthenticated vulnerabilities. Attack complexity is low (AC:L), meaning exploitation requires no special conditions beyond valid user credentials, making this automatable once access is obtained. No EPSS score is available for predictive risk modeling, but the public availability of the GitHub security advisory (GHSA-hc37-vx3w-34fg) with detailed technical explanation and the fixed commit diff effectively serves as proof-of-concept material, lowering the skill barrier for exploitation. Absence from CISA KEV suggests no confirmed widespread or targeted exploitation campaigns as of analysis date. The high confidentiality impact is concerning for church management systems that typically store personally identifiable information (PII) including names, addresses, phone numbers, email addresses, donation records, and financial data of congregation members. The low integrity impact (VI:L) suggests write operations are constrained-possibly by database permissions or query context-limiting but not eliminating data tampering risk. For SSVC decision framework: exploitation is Public (PoC available via GitHub), automatable (yes, once authenticated), technical impact is Partial (data exfiltration but not total system compromise). Priority depends on organizational exposure: deployments with untrusted authenticated users (e.g., volunteer access, large congregations with many user accounts) face higher risk than small installations with tightly controlled administrator-only access.

An authenticated attacker with low-privilege user credentials (such as a volunteer with financial data entry permissions) accesses the ChurchCRM financial scanning interface and manipulates the routing/account number input field. Instead of legitimate banking data, the attacker injects SQL syntax such as ' UNION SELECT username,password,email FROM users-- to append a secondary query that extracts user credentials and member contact information from the database. The unsanitized $routeAndAccount parameter passes the malicious payload directly into the SQL query executed by getMemberByScanString(), causing the database to return both the expected financial lookup results and the injected credential dump. The attacker iterates through different table names and column structures to systematically exfiltrate donation records, personally identifiable information of congregation members, and administrative credentials, which could enable privilege escalation for subsequent attacks. Public proof-of-concept code is available via the GitHub security advisory GHSA-hc37-vx3w-34fg.