A critical SQL injection vulnerability in ChurchCRM allows unauthenticated attackers to compromise database integrity and gain unauthorized access to sensitive information.

This vulnerability is caused by improper neutralization of special elements used in an SQL command (CWE-89) within the legacy /Reports/ConfirmReportEmail.php endpoint. Despite the feature being removed from the user interface, the file remains reachable and exploitable by an unauthenticated attacker via the familyId parameter.

The ability to perform SQL injection poses a severe risk to data confidentiality, integrity, and availability. An attacker can leverage this flaw to extract sensitive member information, modify database contents, or potentially gain full control over the application backend, leading to significant reputational damage and operational disruption. The CVSS score of 8.8 reflects the high severity of this vulnerability, particularly given that it does not require authentication to exploit.

Immediate Action: Update ChurchCRM to version 6.5.3 or later immediately to remove the vulnerable code path.

Proactive Monitoring: Review web server access logs for anomalous requests targeting the /Reports/ConfirmReportEmail.php endpoint and monitor database query logs for suspicious SQL patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection attempts targeting the specified parameter.

Public Exploit Available: Yes, a public proof-of-concept exists on GitHub (https://github.com/lukasz-rybak/CVE-2025-68400).

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability presents an urgent risk to ChurchCRM deployments. Administrators must prioritize updating to version 6.5.3 to eliminate the legacy code and secure the application against potential data breaches.