CVE-2025-1023: SQL Injection in ChurchCRM newCountName Parameter via EditEventTypes.php
First published: Tue Feb 18 2025(Updated: )
A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to execute arbitrary SQL queries by exploiting a time-based blind SQL Injection vulnerability in the EditEventTypes functionality. The newCountName parameter is directly concatenated into an SQL query without proper sanitization, allowing an attacker to manipulate database queries and execute arbitrary commands, potentially leading to data exfiltration, modification, or deletion.
Credit: b7efe717-a805-47cf-8e9a-921fca0ce0ce
| Affected Software | Affected Version | How to fix |
|---|---|---|
| ChurchCRM | <5.13.0 |
Remedy
To prevent SQL injection, use prepared statements with parameterised queries. Additionally, implement input validation to reject dangerous characters, apply the principle of least privilege to database users to minimise potential damage, and assign appropriate data types in PHP, such as converting newCountName to an integer if it represents a numeric value.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-1023?
CVE-2025-1023 is classified as a high-severity vulnerability due to its potential for remote code execution through SQL injection.
How do I fix CVE-2025-1023?
To fix CVE-2025-1023, update ChurchCRM to version 5.13.1 or later, where the vulnerability has been patched.
What impact does CVE-2025-1023 have on ChurchCRM?
CVE-2025-1023 allows attackers to execute arbitrary SQL queries, which could lead to data leakage or manipulation.
Is CVE-2025-1023 easily exploitable?
Yes, CVE-2025-1023 is easily exploitable due to the lack of proper input sanitization in the affected functionality.
Which versions of ChurchCRM are affected by CVE-2025-1023?
ChurchCRM versions 5.13.0 and prior are affected by CVE-2025-1023.
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/remedy
- agent/weakness
- agent/references
- agent/description
- agent/first-publish-date
- agent/type
- agent/guess-ai
- agent/software-canonical-lookup
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/author
- agent/source
- agent/last-modified-date
- agent/severity
- agent/tags
- agent/event
- vendor/churchcrm
- canonical/churchcrm