EUVD-2026-19809
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Description
ChurchCRM is an open-source church management system. Prior to 7.1.0, a critical SQL injection vulnerability exists in ChurchCRM's PropertyTypeEditor.php where the Name and Description POST parameters are sanitized only with strip_tags() before direct concatenation into SQL queries. This allows authenticated users with "Manage Properties" permission to execute arbitrary SQL commands including data exfiltration, modification, and deletion. Injected data persists in the database and is reflected across multiple application pages without output encoding. This vulnerability is fixed in 7.1.0.
Analysis
SQL injection in ChurchCRM's PropertyTypeEditor.php allows authenticated users with 'Manage Properties' permission to execute arbitrary SQL commands through unsanitized Name and Description POST parameters. ChurchCRM versions prior to 7.1.0 are affected. …
Sign in for full analysis, threat intelligence, and remediation guidance.
Remediation
Within 24 hours: Identify all ChurchCRM installations and document current versions; immediately restrict 'Manage Properties' permission assignments to only essential administrators and audit existing role assignments. Within 7 days: Contact ChurchCRM vendor for patch availability timeline and interim guidance; implement application-level access controls (firewall rules, IP whitelisting) limiting PropertyTypeEditor.php access to trusted administrators only. …
Sign in for detailed remediation steps.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today