CVE-2025-1133: SQL Injection in ChurchCRM EID Parameter via EditEventAttendees.php
First published: Wed Feb 19 2025(Updated: )
A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to execute arbitrary SQL queries by exploiting a boolean-based blind SQL Injection vulnerability in the EditEventAttendees functionality. The EID parameter is directly concatenated into an SQL query without proper sanitization, making it susceptible to SQL injection attacks. An attacker can manipulate the query, potentially leading to data exfiltration, modification, or deletion. Please note that this vulnerability requires Administrator privileges.
Credit: b7efe717-a805-47cf-8e9a-921fca0ce0ce
| Affected Software | Affected Version | How to fix |
|---|---|---|
| ChurchCRM | <5.13.0 |
Remedy
To prevent SQL injection, use prepared statements with parameterised queries. Additionally, implement input validation to reject dangerous characters, apply the principle of least privilege to database users to minimise potential damage, and assign appropriate data types in PHP, such as converting EID to an integer if it represents a numeric value.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-1133?
CVE-2025-1133 is classified as a critical vulnerability due to its potential for SQL injection and arbitrary code execution.
How do I fix CVE-2025-1133?
To fix CVE-2025-1133, upgrade to ChurchCRM version 5.13.1 or later, where the vulnerability has been patched.
What systems are affected by CVE-2025-1133?
CVE-2025-1133 affects ChurchCRM versions 5.13.0 and earlier.
What kind of attack can be executed using CVE-2025-1133?
CVE-2025-1133 allows attackers to execute arbitrary SQL queries through a boolean-based blind SQL injection.
How can I detect if my system is vulnerable to CVE-2025-1133?
You can detect CVE-2025-1133 by running security scans on ChurchCRM installations for known SQL injection vulnerabilities.
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/title
- agent/remedy
- agent/references
- agent/type
- agent/description
- agent/first-publish-date
- agent/guess-ai
- agent/software-canonical-lookup
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/severity
- agent/author
- agent/last-modified-date
- agent/source
- agent/tags
- agent/event
- vendor/churchcrm
- canonical/churchcrm