An authenticated SQL injection vulnerability in ChurchCRM version 7.1.0 and prior poses a high risk of total system compromise.

This is an SQL injection vulnerability (CWE-89) located in the /EventNames.php file. The vulnerability occurs because the newEvtTypeCntLst parameter is not properly sanitized before being interpolated into an SQL query, allowing authenticated users with AddEvent privileges to manipulate database operations.

The vulnerability carries a CVSS score of 8.8, reflecting its potential for total impact on confidentiality, integrity, and availability. Successful exploitation allows an attacker to bypass security controls, extract sensitive church member data, modify records, or potentially execute administrative database tasks, leading to significant reputational damage and data loss.

Immediate Action: Update ChurchCRM to version 7.1.0 or later to apply the necessary input sanitization fix.

Proactive Monitoring: Review application access logs for anomalous database queries originating from the /EventNames.php endpoint, particularly those containing SQL syntax characters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns in incoming HTTP requests.

Public Exploit Available: Unknown

Given the high CVSS score and the existence of a proof-of-concept, organizations running ChurchCRM must prioritize upgrading to version 7.1.0. Failure to patch leaves the backend database exposed to unauthorized manipulation by any authenticated user with event management privileges.