An SQL injection vulnerability in ChurchCRM allows authenticated users to manipulate the backend database, posing a critical risk to data integrity and confidentiality.

The application fails to properly sanitize input in the type array parameter within the /SettingsIndividual.php file. Any authenticated user can leverage this flaw to execute arbitrary SQL commands against the database.

Successful exploitation of this SQL injection vulnerability grants an attacker the ability to view, modify, or delete sensitive data stored within the ChurchCRM database. Given the CVSS score of 8.8, this flaw represents a high risk that could lead to unauthorized access to member data, financial records, and core system configurations, potentially resulting in significant operational disruption.

Immediate Action: Update ChurchCRM to version 7.1.0 or later immediately to resolve the vulnerable code path.

Proactive Monitoring: Review application access logs for suspicious activity targeting the /SettingsIndividual.php endpoint, particularly requests containing unusual characters or SQL syntax in the type parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns, which serves as a temporary protective layer while the update is being staged.

Public Exploit Available: Unknown (no confirmed public weaponized exploit or published Proof-of-Concept identified in curated sources).

The severity of this SQL injection vulnerability necessitates prompt attention from security administrators. Because the flaw allows authenticated users to compromise the database, upgrading to version 7.1.0 is the only reliable method to eliminate the risk. Organizations should prioritize this update to prevent potential data exfiltration or unauthorized system modification.