CVE-2025-7860 in Church Donation System
Summary
by MITRE • 07/20/2025
A vulnerability, which was classified as critical, has been found in code-projects Church Donation System 1.0. This issue affects some unknown processing of the file /members/login_admin.php. The manipulation of the argument Username leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/30/2025
This critical vulnerability in the code-projects Church Donation System version 1.0 represents a severe sql injection flaw that directly impacts the administrative login functionality. The vulnerability exists within the /members/login_admin.php file where the Username parameter is improperly handled during input processing. This flaw allows attackers to manipulate the authentication system through maliciously crafted sql queries that can be injected via the Username field, potentially compromising the entire administrative interface.
The technical nature of this vulnerability aligns with CWE-89 which specifically addresses sql injection attacks where untrusted data is incorporated into sql commands without proper sanitization or parameterization. The attack vector is remote, meaning an attacker can exploit this vulnerability without requiring physical access to the system or local network presence. This remote exploit capability significantly increases the threat surface and makes the system vulnerable to widespread exploitation across the internet.
The operational impact of this vulnerability is substantial as it provides attackers with direct access to the administrative backend of the church donation system. Successful exploitation could enable unauthorized users to bypass authentication mechanisms, access sensitive donor information, modify donation records, and potentially escalate privileges to gain full system control. Given that this is a church donation system, the data at risk includes personal financial information of donors, which could lead to identity theft, financial fraud, and privacy violations.
The public disclosure of this exploit creates an immediate security risk for all affected systems, as threat actors can leverage existing attack frameworks to compromise vulnerable installations. This vulnerability directly maps to several ATT&CK techniques including T1190 for exploitation of remote services and T1071.004 for application layer protocol usage. Organizations should prioritize immediate remediation efforts, including applying patches, implementing proper input validation, and considering web application firewalls to mitigate the risk. The vulnerability demonstrates the critical importance of proper parameterized queries and input sanitization in preventing sql injection attacks that can undermine the integrity and confidentiality of sensitive data systems.