A critical SQL injection vulnerability in ChurchCRM versions prior to 7.1.0 allows authenticated attackers to bypass security controls and exfiltrate sensitive database information.

The flaw resides in the PropertyTypeEditor.php script, where the replacement of legacy filtering functions with inadequate sanitization allows for SQL injection. An authenticated user with the MenuOptions role can exploit this via the Name or Description fields to perform time-based blind injection.

Successful exploitation allows an attacker to exfiltrate the entire database, including sensitive user password hashes and personal information. Given the CVSS score of 8.1, this represents a high-severity risk to data confidentiality and integrity, potentially leading to unauthorized system access and significant reputational damage for the organization.

Immediate Action: Upgrade ChurchCRM to version 7.1.0 or later to ensure the vulnerable input handling is correctly addressed.

Proactive Monitoring: Review database access logs for anomalous query patterns, particularly time-based delays that may indicate blind SQL injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns in HTTP requests directed at the administration interface.

Public Exploit Available: Unknown

Organizations utilizing ChurchCRM must prioritize the update to version 7.1.0 immediately to remediate this SQL injection vulnerability. Given the ease of exploitation by low-privileged accounts and the potential for full database compromise, delaying this patch poses an unacceptable security risk to organizational data.