The Church Donation System 1.0 contains a critical SQL injection vulnerability that allows unauthenticated remote attackers to manipulate backend database queries.

This vulnerability is caused by improper neutralization of special elements used in an SQL command (CWE-89) within the /members/offering.php file. The trcode parameter is susceptible to manipulation, allowing an unauthenticated attacker to inject malicious SQL queries directly into the database.

Successful exploitation of this vulnerability could lead to unauthorized access to sensitive donor information, modification of financial records, or complete compromise of the application database. With a CVSS score of 7.3, this flaw poses a significant risk to data integrity and confidentiality for organizations relying on this software for donation management.

Immediate Action: Since no official patch is currently available, administrators should immediately restrict access to the /members/offering.php endpoint or disable the affected module until a vendor-supplied update is released.

Proactive Monitoring: Monitor server access logs for anomalous HTTP requests containing SQL syntax patterns or unexpected characters directed at the offering.php script.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting input parameters.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the provided vulnerability references.

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability presents a credible risk to the integrity of the Church Donation System. Organizations should prioritize isolating the affected component and implementing robust input validation via a WAF until the vendor provides a formal security update.