CVE-2025-1132 Details

A time-based blind SQL injection vulnerability has been identified in ChurchCRM versions through 5.13.0. The issue resides in the EditEventAttendees.php file, specifically within the EN_tyid parameter, which is vulnerable to injection as it is directly included in an SQL query without adequate sanitization. This vulnerability requires administrator permissions to exploit. Attackers can use this flaw to introduce malicious SQL commands, potentially leading to unauthorized data access or manipulation by exploiting the time-based nature of the injection to extract information from the database.

To address this vulnerability, ChurchCRM should implement prepared statements or parameterized queries to prevent SQL injection. Additionally, input validation should be enforced to ensure only expected and valid data is accepted. Reviewing and restricting database permissions for application users can further mitigate the risk of exploitation.