ChurchCRM versions prior to 6.5.0 contain a high-severity SQL injection vulnerability that permits authenticated attackers with event management permissions to compromise the underlying database.

This vulnerability is a SQL injection (CWE-89) located in the EventEditor.php file. An authenticated user possessing event management privileges (isAddEvent) can inject malicious SQL commands through the unsanitized EN_tyid POST parameter.

The ability to execute arbitrary SQL queries represents a significant risk to data integrity, confidentiality, and availability. An attacker could potentially extract sensitive member information, modify administrative records, or disrupt system operations. Given the CVSS score of 7.2, this vulnerability is classified as High severity, as it provides a clear path for database-level exploitation by an authenticated actor.

Immediate Action: Upgrade ChurchCRM to version 6.5.0 or later to ensure the input sanitization patch is applied.

Proactive Monitoring: Review application access logs for suspicious POST requests directed at EventEditor.php, particularly those containing unexpected special characters or SQL syntax patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection attempts targeting common parameters.

Public Exploit Available: Unknown

Organizations utilizing ChurchCRM should prioritize this update as part of their next maintenance cycle. Because the vulnerability allows for direct interaction with the database layer, failure to patch could lead to a complete compromise of the application data. Apply the version 6.5.0 update immediately to mitigate the risk of SQL injection.