CVE-2025-1133criticalCWE-89

CVE-2025-1133: fallo crítico en ChurchCRM

SQL Injection in ChurchCRM EID Parameter via EditEventAttendees.php

Publicada el

Seguir esta CVE+ Monitorear ChurchCRM

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

28Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 9.3epss 0.6%
A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to execute arbitrary SQL queries by exploiting a boolean-based blind SQL Injection vulnerability in the EditEventAttendees functionality. The EID parameter is directly concatenated into an SQL query without proper sanitization, making it susceptible to SQL injection attacks. An attacker can manipulate the query, potentially leading to data exfiltration, modification, or deletion.  Please note that this vulnerability requires Administrator privileges.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:L/SA:H/AU:Y/R:U/V:C/RE:H/U:Red
Productos afectados
ChurchCRM · ChurchCRM
CVEs relacionadas — ChurchCRM

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-1023CRITICALSQL Injection in ChurchCRM newCountName Parameter via EditEventTypes.phpEPSS 2.5%CVE-2025-1135CRITICALSQL Injection in ChurchCRM CurrentFundraiser Parameter via BatchWinnerEntry.phpEPSS 0.8%CVE-2025-1134CRITICALSQL Injection in ChurchCRM CurrentFundraiser Parameter via DonatedItemEditor.phpEPSS 0.8%CVE-2025-1132CRITICALSQL Injection in ChurchCRM EN_tyid Parameter via EditEventAttendees.phpEPSS 0.6%CVE-2025-1024HIGHSession Hijacking via Reflected Cross-Site Scripting (XSS) in ChurchCRM EditEventAttendees.php EID ParameterEPSS 0.3%CVE-2025-0981HIGHSession Hijacking via Stored Cross-Site Scripting (XSS) in ChurchCRM GroupEditor.php Description FieldEPSS 0.2%