A critical time-based SQL injection vulnerability in ChurchCRM allows authenticated attackers to potentially access or modify sensitive database information.

The application fails to properly sanitize user input in the familyId parameter within the Reports/ConfirmReportEmail.php endpoint, leading to an SQL injection flaw. This vulnerability requires the attacker to be an authenticated user to successfully trigger the injection.

Successful exploitation of this flaw allows an authenticated attacker to execute arbitrary SQL commands, potentially leading to the unauthorized disclosure or manipulation of sensitive church member data. With a CVSS score of 8.1, this high-severity vulnerability poses a significant risk to data confidentiality and integrity, necessitating prompt remediation to prevent potential data breaches.

Immediate Action: Upgrade your ChurchCRM installation to version 7.1.0 or later immediately to apply the vendor-supplied security patch.

Proactive Monitoring: Review application logs for suspicious patterns or anomalous time-based delays in database query execution, which may indicate attempted exploitation.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns targeting the Reports/ConfirmReportEmail.php endpoint.

Public Exploit Available: Unknown.

Given the high CVSS score and the existence of a proof-of-concept, this vulnerability presents a credible threat to your organization. IT administrators must prioritize updating ChurchCRM to version 7.1.0 or newer to close this security gap and prevent unauthorized database access.