EUVD-2026-19722
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Description
ChurchCRM is an open-source church management system. Prior to 7.1.0, the NewRole POST parameter in src/MemberRoleChange.php is used in an SQL query without proper integer validation, allowing authenticated users to inject arbitrary SQL. The attack requires an authenticated session with ManageGroups role, knowledge of a valid GroupID and PersonID (obtainable from GroupView or PersonView pages) This vulnerability is fixed in 7.1.0.
Analysis
SQL injection in ChurchCRM versions prior to 7.1.0 allows authenticated users with ManageGroups role to execute arbitrary SQL commands via the NewRole POST parameter in MemberRoleChange.php. The vulnerability requires low-privilege authentication (PR:L) but permits complete database compromise with high confidentiality, integrity, and availability impact. …
Sign in for full analysis, threat intelligence, and remediation guidance.
Remediation
Within 24 hours: Identify all ChurchCRM instances and document current versions; restrict ManageGroups role assignment to trusted administrators only. Within 7 days: Upgrade to ChurchCRM 7.1.0 or later; test in non-production environment first. …
Sign in for detailed remediation steps.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today