What is the CVSS score of EUVD-2026-19808?

EUVD-2026-19808 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by EUVD-2026-19808?

ChurchCRM versions prior to 7.1.0 contain a SQL injection vulnerability in GroupPropsFormRowOps.php that allows authenticated users to execute arbitrary database commands, potentially compromising…. A patch is available.

How to fix or mitigate EUVD-2026-19808?

Within 24 hours: identify all ChurchCRM instances in your environment and document current versions. Within 7 days: upgrade all ChurchCRM deployments to version 7.1.0 or later; test in a non-production environment first to ensure compatibility with customizations. Within 30 days: audit database access logs for suspicious SQL activity from authenticated user accounts post-deployment; implement database activity monitoring if not already in place.

PHP EUVD-2026-19808

| CVE-2026-39318 HIGH

SQL Injection (CWE-89)

2026-04-07 GitHub_M

PHP SQLi

8.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:03 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

7.1.0

Re-analysis Queued

Apr 15, 2026 - 20:22 vuln.today

cvss_changed

EUVD ID Assigned

Apr 07, 2026 - 18:00 euvd

EUVD-2026-19808

Analysis Generated

Apr 07, 2026 - 18:00 vuln.today

CVE Published

Apr 07, 2026 - 17:27 nvd

HIGH 8.8

DescriptionGitHub Advisory

ChurchCRM is an open-source church management system. Prior to 7.1.0, the GroupPropsFormRowOps.php file contains a SQL injection vulnerability. User input in the Field parameter is directly inserted into SQL queries without proper sanitization. The mysqli_real_escape_string() function does not escape backtick characters, allowing attackers to break out of SQL identifier context and execute arbitrary SQL statements. This vulnerability is fixed in 7.1.0.

AnalysisAI

SQL injection in ChurchCRM GroupPropsFormRowOps.php allows authenticated attackers to execute arbitrary SQL commands and extract, modify, or destroy database contents. The Field parameter accepts unsanitized user input that is inserted directly into SQL queries; while mysqli_real_escape_string() is applied, it fails to escape backtick characters, enabling attackers to break out of SQL identifier context. Affects all versions prior to 7.1.0. With network-accessible attack vector (AV:N), low complexity (AC:L), and requiring only low-privilege authentication (PR:L), this vulnerability poses significant risk to church management systems with authenticated user access. EPSS data not available; no CISA KEV status indicating confirmed active exploitation; exploit scenario is straightforward given the technical details disclosed in the GitHub advisory.

Technical ContextAI

This vulnerability resides in ChurchCRM's GroupPropsFormRowOps.php module, which handles group property operations in the church management application. The root cause (CWE-89: SQL Injection) stems from insufficient input validation where the Field parameter is embedded into dynamically constructed SQL queries. The developers attempted sanitization using PHP's mysqli_real_escape_string() function, but this function has a known limitation: it does not escape backtick characters. In MySQL/MariaDB contexts, backticks are used as identifier delimiters (for table/column names), so an attacker can inject a backtick to close the identifier context and append arbitrary SQL commands such as UNION SELECT statements, UPDATE clauses, or DROP commands. The affected product per CPE is cpe:2.3:a:churchcrm:crm:*:*:*:*:*:*:*:*, indicating all ChurchCRM versions prior to the patched release. This is a classic second-order SQL injection scenario where developer-applied escaping functions prove inadequate against specific SQL syntax elements.

RemediationAI

Upgrade ChurchCRM to version 7.1.0 or later, which contains the fix for this SQL injection vulnerability. The vendor-released patch addresses the improper input sanitization in GroupPropsFormRowOps.php by implementing parameterized queries or proper escaping mechanisms that handle backtick characters correctly. Administrators should download version 7.1.0 from the official ChurchCRM GitHub repository at https://github.com/ChurchCRM/CRM and follow standard upgrade procedures including database backups prior to patching. If immediate patching is not feasible, temporary mitigations include restricting access to the affected GroupPropsFormRowOps.php endpoint through web application firewall rules, implementing strict input validation at the network perimeter to block backtick characters in the Field parameter, and conducting access control reviews to ensure only trusted users possess authenticated credentials. However, these workarounds are not substitutes for applying the official patch. Organizations should also review database audit logs for suspicious query patterns that may indicate prior exploitation attempts, such as UNION-based queries or unusual administrative commands executed through the application context. Full advisory details and patch information are available at https://github.com/ChurchCRM/CRM/security/advisories/GHSA-j3vj-59vv-h4rc.