CVE-2026-44418 Details
Description
EcclesiaCRM is CRM Software for church management. In 8.0.0 and earlier, the ValidateInput() function's default case in EcclesiaCRM's query view passes user-supplied POST parameters directly into SQL queries via str_replace without any sanitization, enabling SQL injection through query parameters that use non-standard validation types. This is caused by an incomplete fix for CVE-2026-35184.
A SQL injection vulnerability has been identified in EcclesiaCRM versions through 8.0.0. The issue arises in the ValidateInput() function's default case, where user-supplied POST parameters are directly inserted into SQL queries without proper sanitization. This flaw allows SQL injection through query parameters that utilize non-standard validation types. The vulnerability is a result of an incomplete fix for a previous SQL injection issue.
The vulnerability has been partially addressed by applying InputUtils::LegacyFilterInput() to the default case in the ValidateInput() function. However, this blocklist-based filter may not effectively catch all SQL injection vectors. It is recommended to replace the str_replace() function in ProcessSQL() with PDO prepared statements that use :alias placeholders. If modifying the SQL template is too disruptive, at the very least, use the PDO quote() method on all substituted values.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 13, 2026CISA-ADP
Assessed May 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/phili67/ecclesiacrm/commit/f743b97f89da469a4c70b82bd61d0a59a3a957a9 | [email protected] | Source CodeVendor |
| https://github.com/phili67/ecclesiacrm/security/advisories/GHSA-vmgq-gpf9-mjjj | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| EcclesiaCRM | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 13, 2026 | New CVE Received | [email protected] |