An authenticated SQL injection vulnerability in ChurchCRM versions prior to 6.5.3 permits an administrator to execute arbitrary database commands, posing a high risk of total system compromise.

This vulnerability is a SQL injection (CWE-89) located in the src/UserEditor.php file. It occurs because the application fails to sanitize the keys of the type POST parameter array before including them in SQL queries, which can be triggered by a user with administrator privileges.

The ability to execute arbitrary SQL commands provides an attacker with complete control over the application database, potentially leading to unauthorized data extraction, modification, or deletion. With a CVSS score of 7.2, this vulnerability represents a significant security risk, as a compromised administrative account can leverage this flaw to escalate access or maintain persistence within the environment.

Immediate Action: Update ChurchCRM to version 6.5.3 or later immediately to apply the necessary sanitization and type-casting logic.

Proactive Monitoring: Review database audit logs for anomalous query patterns, particularly those originating from the UserEditor.php endpoint or involving unexpected SQL syntax.

Compensating Controls: Implement a Web Application Firewall (WAF) configured to detect and block common SQL injection patterns in HTTP POST requests as a temporary defensive measure.

Public Exploit Available: Unknown.

Given the potential for total database compromise, organizations running ChurchCRM must prioritize upgrading to version 6.5.3. While the attack requires administrative access, the risk remains high due to the potential for lateral movement or malicious activity by a compromised account. Administrators should ensure that all internal access controls are strictly enforced until the patch is applied.