ChurchCRM is affected by a SQL injection vulnerability that allows authenticated users with specific privileges to compromise the underlying database, posing a high risk of unauthorized data manipulation.

This is a SQL injection flaw (CWE-89) located in the eGive.php script. The vulnerability permits an authenticated user with finance-level privileges to inject malicious SQL commands through the MissingEgive_FamID_ POST parameter.

Successful exploitation of this vulnerability allows an attacker to bypass standard database controls, leading to unauthorized data access, modification, or complete deletion of records. Given the CVSS score of 7.2, this represents a significant risk to the integrity and confidentiality of sensitive church management data, which may include donor information or financial records.

Immediate Action: Upgrade ChurchCRM to version 6.5.3 or later, as this release contains the necessary security patch to neutralize the vulnerable parameter.

Proactive Monitoring: Review web server and application logs for suspicious POST requests containing unexpected SQL syntax or unusual activity directed at the eGive.php endpoint.

Compensating Controls: Implement a Web Application Firewall (WAF) to inspect incoming POST parameters and block requests containing common SQL injection patterns until the update can be applied.

Public Exploit Available: Unknown

The presence of a known SQL injection vulnerability in a management system necessitates immediate patching to prevent potential data breaches. Security administrators must prioritize upgrading to version 6.5.3 to eliminate the attack vector and ensure the continued integrity of the application environment.