Crm
Monthly
SQL injection in ChurchCRM versions prior to 7.1.0 allows authenticated users with low privileges to execute arbitrary SQL commands via the fund raiser statement report functionality. The vulnerability stems from inadequate input validation of session-based fundraiser identifiers in src/Reports/FundRaiserStatement.php, enabling attackers to achieve complete database compromise including data exfiltration, modification, and potential remote code execution. EPSS exploitation probability and KEV status unavailable, but public advisory exists from GitHub Security (GHSA-grq6-q49f-44xh). No public exploit identified at time of analysis, though SQL injection exploits are well-documented and exploitation complexity is low per CVSS vector (AC:L).
SQL injection in ChurchCRM versions prior to 7.1.0 allows authenticated users with low privileges to execute arbitrary SQL commands via the fund raiser statement report functionality. The vulnerability stems from inadequate input validation of session-based fundraiser identifiers in src/Reports/FundRaiserStatement.php, enabling attackers to achieve complete database compromise including data exfiltration, modification, and potential remote code execution. EPSS exploitation probability and KEV status unavailable, but public advisory exists from GitHub Security (GHSA-grq6-q49f-44xh). No public exploit identified at time of analysis, though SQL injection exploits are well-documented and exploitation complexity is low per CVSS vector (AC:L).