CVE-2025-1023: critical vulnerability in ChurchCRM
SQL Injection in ChurchCRM newCountName Parameter via EditEventTypes.php
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
65Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actcvss 9.3epss 2.5%
from disclosure to weapon
Published on NVDFeb 18
VulnCheck+348d
A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to execute arbitrary SQL queries by exploiting a time-based blind SQL Injection vulnerability in the EditEventTypes functionality. The newCountName parameter is directly concatenated into an SQL query without proper sanitization, allowing an attacker to manipulate database queries and execute arbitrary commands, potentially leading to data exfiltration, modification, or deletion.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:L/SA:H/AU:Y/R:U/V:C/RE:H/U:Red
Affected products
ChurchCRM · ChurchCRMRelated CVEs — ChurchCRM
In the same product, most dangerous first.
CVE-2025-1135CRITICALSQL Injection in ChurchCRM CurrentFundraiser Parameter via BatchWinnerEntry.phpEPSS 0.8%CVE-2025-1134CRITICALSQL Injection in ChurchCRM CurrentFundraiser Parameter via DonatedItemEditor.phpEPSS 0.8%CVE-2025-1133CRITICALSQL Injection in ChurchCRM EID Parameter via EditEventAttendees.phpEPSS 0.6%CVE-2025-1132CRITICALSQL Injection in ChurchCRM EN_tyid Parameter via EditEventAttendees.phpEPSS 0.6%CVE-2025-1024HIGHSession Hijacking via Reflected Cross-Site Scripting (XSS) in ChurchCRM EditEventAttendees.php EID ParameterEPSS 0.3%CVE-2025-0981HIGHSession Hijacking via Stored Cross-Site Scripting (XSS) in ChurchCRM GroupEditor.php Description FieldEPSS 0.2%