ChurchCRM versions prior to 7.1.0 are vulnerable to a critical second order SQL injection attack that allows authenticated users to compromise sensitive database information.

This vulnerability is a second order SQL injection (CWE-89) located in the /FundRaiserEditor.php endpoint. An attacker with any level of authenticated access can inject arbitrary SQL commands through the iCurrentFundraiser PHP session parameter, bypassing security controls to manipulate the backend database.

The ability to perform unauthorized SQL queries poses a severe risk to the confidentiality, integrity, and availability of the organization's data. With a CVSS score of 8.8, this vulnerability is classified as High, as it could lead to full database compromise, including the exposure of member records, financial data, or administrative credentials.

Immediate Action: Update ChurchCRM to version 7.1.0 or later immediately to incorporate the security patch provided by the vendor.

Proactive Monitoring: Review web server and application access logs for unusual patterns in requests to /FundRaiserEditor.php, particularly those containing SQL syntax or unexpected session parameter values.

Compensating Controls: Deploy a Web Application Firewall (WAF) with custom rules to filter and block malicious SQL injection patterns directed at the identified PHP session parameter.

Public Exploit Available: Unknown.

Given the High severity of this SQL injection flaw and the existence of a proof-of-concept, administrators must prioritize upgrading to version 7.1.0. Failure to patch allows any authenticated user to potentially exfiltrate or corrupt the entirety of the ChurchCRM database, representing a significant operational and security risk.