An authenticated SQL injection vulnerability in ChurchCRM versions prior to 7.1.0 poses a high risk of database compromise and unauthorized data manipulation.

The application fails to properly sanitize the Value parameter within the /PropertyAssign.php endpoint. This flaw allows an authenticated user with ManageGroups and isEditRecordsEnabled privileges to execute arbitrary SQL commands.

This vulnerability carries a CVSS score of 8.8, indicating a high level of severity. Successful exploitation allows an attacker to bypass data integrity controls, potentially resulting in the unauthorized extraction of sensitive member information, modification of records, or complete compromise of the backend database.

Immediate Action: Upgrade ChurchCRM to version 7.1.0 or later immediately to incorporate the necessary input sanitization patches.

Proactive Monitoring: Review database access logs for unusual queries, specifically those originating from the /PropertyAssign.php endpoint, and monitor for unexpected administrative account activity.

Compensating Controls: Implement a Web Application Firewall (WAF) to filter and block malicious SQL injection patterns targeting the /PropertyAssign.php endpoint until the software update can be applied.

Public Exploit Available: Unknown.

Given the high CVSS score and the potential for full database compromise, this vulnerability represents a significant security risk. IT administrators must prioritize the update to version 7.1.0 across all instances of ChurchCRM to neutralize the threat of SQL injection.