| عنوان | ChurchCRM <= 5.18.0 SQL Injection |
|---|
| الوصف | SQL injection vulnerability in ChurchCRM's EditEventAttendees.php (line 60) where the EID parameter is directly concatenated into SQL queries without sanitization or parameterized statements. Any authenticated user can inject arbitrary SQL commands using UNION-based techniques to extract complete database contents including administrative credentials, church member personal information, financial records, and donation data. The vulnerability enables privilege escalation, data manipulation, and potential system takeover through database compromise. |
|---|
| المصدر | ⚠️ https://github.com/uartu0/advisories/blob/main/churchcrm-sql-injection-2025.md |
|---|
| المستخدم | uartu0 (UID 90021) |
|---|
| ارسال | 08/10/2025 05:16 AM (6 أشهر منذ) |
|---|
| الاعتدال | 18/10/2025 02:53 PM (10 days later) |
|---|
| الحالة | مكرر |
|---|
| إدخال VulDB | 296272 [ChurchCRM حتى 5.13.0 EditEventAttendees EID حقن SQL] |
|---|
| النقاط | 0 |
|---|