CVE-2025-1132: SQL Injection in ChurchCRM EN_tyid Parameter via EditEventAttendees.php
First published: Wed Feb 19 2025(Updated: )
A time-based blind SQL Injection vulnerability exists in the ChurchCRM 5.13.0 and prior EditEventAttendees.php within the EN_tyid parameter. The parameter is directly inserted into an SQL query without proper sanitization, allowing attackers to inject malicious SQL commands. Please note that the vulnerability requires Administrator permissions. This flaw can potentially allow attackers to delay the response, indicating the presence of an SQL injection vulnerability. While it is a time-based blind injection, it can be exploited to gain insights into the underlying database, and with further exploitation, sensitive data could be retrieved.
Credit: b7efe717-a805-47cf-8e9a-921fca0ce0ce
| Affected Software | Affected Version | How to fix |
|---|---|---|
| ChurchCRM | <5.13.0 |
Remedy
To prevent SQL injection, use prepared statements with parameterised queries. Additionally, implement input validation to reject dangerous characters, apply the principle of least privilege to database users to minimise potential damage, and assign appropriate data types in PHP, such as converting EN_tyid to an integer if it represents a numeric value.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-1132?
CVE-2025-1132 has been classified as a high severity vulnerability due to the risk of SQL injection attacks.
How do I fix CVE-2025-1132?
To fix CVE-2025-1132, you should upgrade ChurchCRM to version 5.13.1 or later where the vulnerability is patched.
What software is affected by CVE-2025-1132?
CVE-2025-1132 affects ChurchCRM versions 5.13.0 and prior.
What type of vulnerability is CVE-2025-1132?
CVE-2025-1132 is a time-based blind SQL Injection vulnerability.
What parameters are involved in CVE-2025-1132?
CVE-2025-1132 involves the EN_tyid parameter in the EditEventAttendees.php file.
- collector/mitre-cve
- source/MITRE
- agent/remedy
- agent/weakness
- agent/title
- agent/first-publish-date
- agent/type
- agent/references
- agent/description
- agent/guess-ai
- agent/software-canonical-lookup
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/author
- agent/last-modified-date
- agent/severity
- agent/source
- agent/tags
- agent/event
- vendor/churchcrm
- canonical/churchcrm