EUVD-2026-19843
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
3Description
ChurchCRM is an open-source church management system. Prior to 7.1.0, The application is vulnerable to time-based SQL injection due to an improper input validation. Endpoint Reports/ConfirmReportEmail.php?familyId= is not correctly sanitising user input, specifically, the sanitised input is not used to create the SQL query. This vulnerability is fixed in 7.1.0.
Analysis
Time-based SQL injection in ChurchCRM versions before 7.1.0 allows authenticated remote attackers to extract sensitive database contents through the ConfirmReportEmail.php endpoint. The familyId parameter fails to properly sanitize user input in SQL query construction, enabling attackers with low-privilege accounts to exfiltrate high-value data including confidential church member information. …
Sign in for full analysis, threat intelligence, and remediation guidance.
Remediation
Within 24 hours: verify current ChurchCRM version and confirm whether your deployment is earlier than 7.1.0; document all user accounts with authentication credentials. Within 7 days: contact ChurchCRM vendor for patch availability timeline and interim security guidance; restrict database query permissions for low-privilege account roles to essential functions only. …
Sign in for detailed remediation steps.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today