CVE-2025-1023 Details
Description
A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to execute arbitrary SQL queries by exploiting a time-based blind SQL Injection vulnerability in the EditEventTypes functionality. The newCountName parameter is directly concatenated into an SQL query without proper sanitization, allowing an attacker to manipulate database queries and execute arbitrary commands, potentially leading to data exfiltration, modification, or deletion.
A time-based blind SQL injection vulnerability has been identified in ChurchCRM versions through 5.13.0. This vulnerability allows attackers to execute arbitrary SQL queries by exploiting the EditEventTypes functionality. The issue arises because the newCountName parameter is concatenated into an SQL query without proper sanitization, enabling manipulation of database queries. This could lead to unauthorized data exfiltration, modification, or deletion.
To address this vulnerability, ChurchCRM should implement prepared statements or parameterized queries to prevent SQL injection. Input validation should be applied to reject dangerous characters, and the principle of least privilege should be enforced for database users to limit potential damage from SQL injection attacks.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Feb 18, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/ChurchCRM/CRM/issues/7246 | Gridware | ExploitIssue TrackingThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | Gridware |
Affected Products
| Product | Versions |
|---|---|
| churchcrm churchcrm | <= 5.13.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | Gridware |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Feb 21, 2025 | Initial Analysis | [email protected] |
| Feb 18, 2025 | New CVE Received | Gridware |