CVE-2025-66313: falha de média gravidade em ChurchCRM CRM
ChurchCRM vulnerable to a time-based blind SQL injection via the 1FieldSec parameter
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.1epss 0.4%
ChurchCRM is an open-source church management system. In ChurchCRM 6.2.0 and earlier, there is a time-based blind SQL injection in the handling of the 1FieldSec parameter. Injecting SLEEP() causes deterministic server-side delays, proving the value is incorporated into a SQL query without proper parameterization. The issue allows data exfiltration and modification via blind techniques.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
Produtos afetados
ChurchCRM · CRMCVEs relacionadas — ChurchCRM CRM
No mesmo produto, das mais perigosas para as menos.
CVE-2025-62521CRITICALChurchCRM has unauthenticated RCE in its Install WizardEPSS 4.5%CVE-2024-39304HIGHChurchCRM SQL Injection VulnerabilityEPSS 3.0%CVE-2025-68109CRITICALChurchCRM vulnerable to RCE with database restore functionalityEPSS 1.5%CVE-2026-39339CRITICALChurchCRM has an API Authentication BypassEPSS 1.4%CVE-2026-40484CRITICALChurchCRM: Authenticated Remote Code Execution via Unrestricted PHP File Write in Database Restore FunctionEPSS 0.9%CVE-2026-35573CRITICALChurchCRM has a Path traversal leads to RCEEPSS 0.8%