CVE-2024-39304highCWE-89

CVE-2024-39304: fallo de gravedad alta en ChurchCRM CRM

ChurchCRM SQL Injection Vulnerability

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear CRM

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

41Vexday Risk Score

Sin señal de explotación. Ella tiene prueba de concepto pública.

ssvc Attendcvss 8.8epss 3.0%
de la publicación al arma5 días
Publicada en NVD26 jul
1ª PoC+5d
ChurchCRM is an open-source church management system. Versions of the application prior to 5.9.2 are vulnerable to an authenticated SQL injection due to an improper sanitization of user input. Authentication is required, but no elevated privileges are necessary. This allows attackers to inject SQL statements directly into the database query due to inadequate sanitization of the EID parameter in in a GET request to `/GetText.php`. Version 5.9.2 patches the issue.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Productos afectados
ChurchCRM · CRM
⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — ChurchCRM CRM

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-62521CRITICALChurchCRM has unauthenticated RCE in its Install WizardEPSS 4.5%CVE-2025-68109CRITICALChurchCRM vulnerable to RCE with database restore functionalityEPSS 1.5%CVE-2026-39339CRITICALChurchCRM has an API Authentication BypassEPSS 1.4%CVE-2026-40484CRITICALChurchCRM: Authenticated Remote Code Execution via Unrestricted PHP File Write in Database Restore FunctionEPSS 0.9%CVE-2026-35573CRITICALChurchCRM has a Path traversal leads to RCEEPSS 0.8%CVE-2026-39337CRITICALChurchCRM Affected by Unauthenticated RCE in Install WizardEPSS 0.7%