A high-severity SQL injection vulnerability in ChurchCRM versions prior to 6.5.3 allows authenticated attackers to execute unauthorized database commands, posing a significant risk to data integrity.

The application fails to properly sanitize the PersonAddress POST parameter in the src/CartToFamily.php file. This allows an authenticated attacker to inject malicious SQL statements, as the input is not cast to an integer like other parameters in the same file.

Successful exploitation of this SQL injection vulnerability could lead to unauthorized access to sensitive church management data, including member information and financial records. Given the CVSS score of 8.8, this flaw represents a significant risk, as it grants attackers the ability to manipulate the underlying database, potentially leading to full compromise of the application data.

Immediate Action: Upgrade ChurchCRM to version 6.5.3 or later to apply the necessary input sanitization fixes.

Proactive Monitoring: Review web server and application access logs for unusual POST requests targeting the src/CartToFamily.php endpoint, particularly those containing SQL syntax characters.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns in HTTP request parameters.

Public Exploit Available: No — there is no confirmation of a public weaponized exploit or published Proof of Concept.

Organizations utilizing ChurchCRM must prioritize the update to version 6.5.3 immediately to remediate this SQL injection flaw. Failure to patch allows authenticated users to bypass security controls and access the backend database, which may result in severe data breaches. Ensure that administrative access controls are audited to limit the potential pool of attackers who could trigger this vulnerability.