Description (CNA)
ChurchCRM is an open-source church management system. In ChurchCRM 6.2.0 and earlier, there is a time-based blind SQL injection in the handling of the 1FieldSec parameter. Injecting SLEEP() causes deterministic server-side delays, proving the value is incorporated into a SQL query without proper parameterization. The issue allows data exfiltration and modification via blind techniques.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| ChurchCRM / CRM | affected <= 6.2.0 |
CWE
CWE-89
References
- https://github.com/ChurchCRM/CRM/security/advisories/GHSA-47q3-c874-mqvp
- https://github.com/ChurchCRM/CRM/commit/719a6bc73245c40e3c30dae6229daaecd451e59f
ADP enrichment
No English description supplied.