CVE-2025-1134: SQL Injection in ChurchCRM CurrentFundraiser Parameter via DonatedItemEditor.php
First published: Wed Feb 19 2025(Updated: )
A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to execute arbitrary SQL queries by exploiting a boolean-based and time-based blind SQL Injection vulnerability in the DonatedItemEditor functionality. The CurrentFundraiser parameter is directly concatenated into an SQL query without sufficient sanitization, allowing an attacker to manipulate database queries and execute arbitrary commands, potentially leading to data exfiltration, modification, or deletion. Please note that this vulnerability requires Administrator privileges.
Credit: b7efe717-a805-47cf-8e9a-921fca0ce0ce
| Affected Software | Affected Version | How to fix |
|---|---|---|
| ChurchCRM | <5.13.0 |
Remedy
To prevent SQL injection, use prepared statements with parameterised queries. Additionally, implement input validation to reject dangerous characters, apply the principle of least privilege to database users to minimise potential damage, and assign appropriate data types in PHP, such as converting CurrentFundraiser to an integer if it represents a numeric value.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-1134?
CVE-2025-1134 is classified as a high severity vulnerability due to its potential for allowing arbitrary SQL query execution.
How do I fix CVE-2025-1134?
To fix CVE-2025-1134, upgrade ChurchCRM to version 5.13.1 or later, which addresses the SQL Injection vulnerability.
What types of attacks can exploit CVE-2025-1134?
CVE-2025-1134 can be exploited through boolean-based and time-based blind SQL Injection attacks.
Which versions of ChurchCRM are affected by CVE-2025-1134?
CVE-2025-1134 affects all versions of ChurchCRM up to and including 5.13.0.
How does CVE-2025-1134 affect data security?
CVE-2025-1134 compromises data security by allowing unauthorized access to the database, potentially exposing sensitive information.
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/title
- agent/remedy
- agent/references
- agent/description
- agent/first-publish-date
- agent/type
- agent/guess-ai
- agent/software-canonical-lookup
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/severity
- agent/author
- agent/last-modified-date
- agent/source
- agent/tags
- agent/event
- vendor/churchcrm
- canonical/churchcrm