CVE-2025-66313 | Teknoloji dünyasından en güncel haberleri ve güvenlikle ilgili gelişmeleri takip edin.

ChurchCRM is an open-source church management system. In ChurchCRM 6.2.0 and earlier, there is a time-based blind SQL injection in the handling of the 1FieldSec…
Medium CVSS: 5.1

CVE-2025-66313

ChurchCRM is an open-source church management system. In ChurchCRM 6.2.0 and earlier, there is a time-based blind SQL injection in the handling of the 1FieldSec parameter. Injecting SLEEP() causes deterministic server-side delays, proving the value is incorporated into a SQL query without proper parameterization. The issue allows data exfiltration and modification via blind techniques.
Vendor
Churchcrm
Product
Churchcrm
CWE
CWE-89
Yayın Tarihi
2025-12-01 23:15:52
Güncelleme
2025-12-03 17:58:24
Source Identifier
security-advisories@github.com
KEV Date Added
-

Kategoriler

CWE-89 Churchcrm MEDIUM Churchcrm 2025

Referanslar

https://github.com/ChurchCRM/CRM/commit/719a6bc73245c40e3c30dae6229daaecd451e59f https://github.com/ChurchCRM/CRM/security/advisories/GHSA-47q3-c874-mqvp https://github.com/ChurchCRM/CRM/security/advisories/GHSA-47q3-c874-mqvp