An authenticated SQL injection vulnerability in ChurchCRM versions prior to 6.5.3 poses a critical risk of full database compromise and unauthorized data exfiltration.

This is a SQL injection vulnerability (CWE-89) located in the src/ListEvents.php file. Any authenticated user can trigger this flaw by sending a malicious payload through the WhichType POST parameter, which lacks proper sanitization and type casting before being processed in SQL queries.

The ability to perform arbitrary SQL queries allows an attacker to exfiltrate, modify, or delete sensitive information, including financial records, personal member data, and user credentials. Given the CVSS score of 8.8, this vulnerability represents a high-severity risk that could lead to the complete compromise of the application and the underlying database integrity.

Immediate Action: Upgrade ChurchCRM to version 6.5.3 or later to apply the necessary input validation patches.

Proactive Monitoring: Review application access logs for suspicious POST requests targeting the src/ListEvents.php endpoint, particularly those containing SQL syntax or unusual time-based delay patterns.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect and block incoming POST requests to src/ListEvents.php that contain unauthorized SQL injection patterns.

Public Exploit Available: Unknown

Organizations utilizing ChurchCRM must prioritize the update to version 6.5.3 immediately. Because this vulnerability allows any authenticated user to bypass logical constraints and access the full database, failure to patch leaves the system open to total data compromise. Please verify that all administrative and standard user accounts are secured and monitor for any anomalous database activity while the update is being staged.