ChurchCRM versions before 7.1.0 contain a critical SQL injection vulnerability that allows authenticated attackers to manipulate database contents and potentially compromise the entire application.

The application fails to properly sanitize the Field parameter within the /GroupPropsFormRowOps.php, /PersonCustomFieldsRowOps.php, and /FamilyCustomFieldsRowOps.php endpoints. This flaw requires the attacker to be an authenticated user with administrative or specific management privileges to execute arbitrary SQL statements.

Successful exploitation allows an attacker with existing administrative access to bypass intended application constraints, modify sensitive database records, and potentially gain full control over the underlying data. Given the CVSS score of 8.8, this represents a high-severity risk that could lead to complete loss of data integrity and unauthorized information disclosure. Such compromises often result in significant reputational damage and operational disruption for the organization.

Immediate Action: Update ChurchCRM to version 7.1.0 or later to apply the security patch provided by the vendor.

Proactive Monitoring: Review web server and application logs for suspicious entries in the affected PHP files, specifically looking for unusual SQL syntax or unexpected character patterns in the Field parameter.

Compensating Controls: Ensure that administrative access to the CRM is restricted to authorized personnel only and consider implementing a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns.

Public Exploit Available: No — there is no confirmed public exploit available.

This vulnerability presents a significant risk to the integrity of the ChurchCRM database. IT administrators should prioritize upgrading to version 7.1.0 immediately to eliminate the injection vector. Given the availability of proof-of-concept information, organizations should treat this update as a high-priority maintenance task to prevent potential exploitation by malicious insiders or compromised administrative accounts.