The Church Donation System version 1.0 is vulnerable to a remote SQL injection flaw that could allow unauthorized database manipulation.

This is a SQL injection vulnerability (CWE-89) occurring in the /members/Tithes.php file, where the trcode argument is not properly sanitized. The vulnerability is exploitable by unauthenticated remote attackers.

Successful exploitation of this SQL injection vulnerability could lead to unauthorized data access or modification within the application database. Given the CVSS score of 7.3, this represents a high risk to data integrity and confidentiality, potentially resulting in the loss of sensitive financial or personal information managed by the donation system.

Immediate Action: As no official patch is currently available, administrators should restrict network access to the affected script or disable the vulnerable module entirely.

Proactive Monitoring: Review web server access logs for anomalous HTTP requests targeting /members/Tithes.php, specifically searching for SQL syntax characters within the trcode parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting this specific endpoint.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the provided technical reference (https://github.com/n0name-yang/myCVE/issues/7).

Given the availability of a public proof-of-concept and the ease of exploitation, immediate defensive action is required. Organizations using the Church Donation System should isolate the affected instance from public networks until the vendor provides a formal security update to remediate the underlying code vulnerability.