CVE-2025-66313 Details
Description
ChurchCRM is an open-source church management system. In ChurchCRM 6.2.0 and earlier, there is a time-based blind SQL injection in the handling of the 1FieldSec parameter. Injecting SLEEP() causes deterministic server-side delays, proving the value is incorporated into a SQL query without proper parameterization. The issue allows data exfiltration and modification via blind techniques.
A time-based blind SQL injection vulnerability has been identified in ChurchCRM versions through 6.2.0. The issue arises in the handling of the '1FieldSec' parameter, where user input is directly incorporated into SQL queries without proper sanitization. This vulnerability allows for data exfiltration and modification using blind SQL injection techniques. Exploitation can be demonstrated by injecting a SLEEP() payload, which causes noticeable server-side delays, indicating successful injection.
Users can update to the patched version of ChurchCRM, which applies input validation to the 'FieldSec' parameters before they are used in SQL queries. Instructions for updating can be found in the ChurchCRM repository on GitHub.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Dec 2, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/ChurchCRM/CRM/security/advisories/GHSA-47q3-c874-mqvp | CISA-ADP | ExploitVendor Advisory |
| https://github.com/ChurchCRM/CRM/commit/719a6bc73245c40e3c30dae6229daaecd451e59f | [email protected] | Patch |
| https://github.com/ChurchCRM/CRM/security/advisories/GHSA-47q3-c874-mqvp | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| churchcrm churchcrm | <= 6.2.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Dec 3, 2025 | Initial Analysis | [email protected] |
| Dec 2, 2025 | CVE Modified | CISA-ADP |
| Dec 1, 2025 | New CVE Received | [email protected] |