CVE-2025-1135: SQL Injection in ChurchCRM CurrentFundraiser Parameter via BatchWinnerEntry.php
First published: Wed Feb 19 2025(Updated: )
A vulnerability exists in ChurchCRM 5.13.0. and prior that allows an attacker to execute arbitrary SQL queries by exploiting a boolean-based and time-based blind SQL Injection vulnerability in the BatchWinnerEntry functionality. The CurrentFundraiser parameter is directly concatenated into an SQL query without sufficient sanitization, allowing an attacker to manipulate database queries and execute arbitrary commands, potentially leading to data exfiltration, modification, or deletion. Please note the vulnerability requires Administrator privileges.
Credit: b7efe717-a805-47cf-8e9a-921fca0ce0ce
| Affected Software | Affected Version | How to fix |
|---|---|---|
| ChurchCRM | <5.13.0 |
Remedy
To prevent SQL injection, use prepared statements with parameterised queries. Additionally, implement input validation to reject dangerous characters, apply the principle of least privilege to database users to minimise potential damage, and assign appropriate data types in PHP, such as converting CurrentFundraiser to an integer if it represents a numeric value.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-1135?
CVE-2025-1135 has a critical severity level due to its potential for executing arbitrary SQL queries.
How do I fix CVE-2025-1135?
To fix CVE-2025-1135, upgrade ChurchCRM to version 5.13.1 or later to mitigate the SQL injection vulnerability.
What versions of ChurchCRM are affected by CVE-2025-1135?
CVE-2025-1135 affects ChurchCRM versions 5.13.0 and prior.
What type of attack does CVE-2025-1135 facilitate?
CVE-2025-1135 allows attackers to perform boolean-based and time-based blind SQL injection attacks.
Which functionality in ChurchCRM is vulnerable in CVE-2025-1135?
The vulnerability in CVE-2025-1135 is found in the BatchWinnerEntry functionality.
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/title
- agent/remedy
- agent/references
- agent/description
- agent/first-publish-date
- agent/type
- agent/guess-ai
- agent/software-canonical-lookup
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/author
- agent/last-modified-date
- agent/severity
- agent/source
- agent/tags
- agent/event
- vendor/churchcrm
- canonical/churchcrm