Home

Description

ChurchCRM is an open-source church management system. In ChurchCRM 6.2.0 and earlier, there is a time-based blind SQL injection in the handling of the 1FieldSec parameter. Injecting SLEEP() causes deterministic server-side delays, proving the value is incorporated into a SQL query without proper parameterization. The issue allows data exfiltration and modification via blind techniques.

PUBLISHED Reserved 2025-11-26 | Published 2025-12-01 | Updated 2025-12-02 | Assigner GitHub_M




MEDIUM: 5.1CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N

Problem types

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Product status

<= 6.2.0
affected

References

github.com/...RM/CRM/security/advisories/GHSA-47q3-c874-mqvp exploit

github.com/...RM/CRM/security/advisories/GHSA-47q3-c874-mqvp

github.com/...ommit/719a6bc73245c40e3c30dae6229daaecd451e59f

cve.org (CVE-2025-66313)

nvd.nist.gov (CVE-2025-66313)

Download JSON