A high-severity SQL injection vulnerability in ChurchCRM allows authenticated users to compromise database integrity and confidentiality.

The application is susceptible to SQL injection (CWE-89) within the /MemberRoleChange.php endpoint. An authenticated user possessing the Manage Groups and Roles capability can execute arbitrary SQL commands via the NewRole parameter.

Successful exploitation of this vulnerability permits an attacker to perform unauthorized database operations, including data exfiltration, modification, or deletion. Given the CVSS score of 8.8, this poses a significant risk to the confidentiality, integrity, and availability of member data managed by the platform. Organizations face potential regulatory compliance issues and loss of sensitive constituent information if this flaw remains unpatched.

Immediate Action: Upgrade ChurchCRM to version 7.1.0 or later to resolve the vulnerability.

Proactive Monitoring: Review application access logs for suspicious activity targeting the /MemberRoleChange.php endpoint, specifically monitoring for unusual characters or SQL syntax in the NewRole parameter.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules designed to detect and block common SQL injection patterns until the software can be updated.

Public Exploit Available: Unknown.

The severity of this SQL injection flaw necessitates immediate attention. Administrators must prioritize updating ChurchCRM to version 7.1.0 to eliminate the injection vector. While the vulnerability requires authentication, the potential for total data compromise makes rapid patching critical to maintaining the security posture of the church management environment.