Description (CNA)
ChurchCRM is an open-source church management system. A SQL Injection vulnerability exists in endpoint `/PaddleNumEditor.php` in ChurchCRM prior to version 6.7.2. Any authenticated user, including one with zero assigned permissions, can exploit SQL injection through the `PerID` parameter. Version 6.7.2 contains a patch for the issue.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| ChurchCRM / CRM | affected < 6.7.2 |
CWE
CWE-89
References
- https://github.com/ChurchCRM/CRM/security/advisories/GHSA-p3q7-q68q-h2gr
- http://github.com/ChurchCRM/CRM/commit/748f5084fc06c5e12463dc7fdd62d1d31fc08d38
ADP enrichment
No English description supplied.
No references supplied.