CVE-2025-67751

ChurchCRM is an open-source church management system. Prior to version 6.5.0, a SQL injection vulnerability exists in the `EventEditor.php` file. When creating a new event and selecting an event type, the `EN_tyid` POST parameter is not sanitized. This allows an authenticated user with event management permissions (`isAddEvent`) to execute arbitrary SQL queries. Version 6.5.0 fixes the issue.

CVSS v3 7.2 HIGH

7.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/ChurchCRM/CRM/commit/2d6cf7aed9af1b9b47e125d1a2266f8e2a88f3fd	Patch
https://github.com/ChurchCRM/CRM/security/advisories/GHSA-wxcc-gvfv-56fg	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:churchcrm:churchcrm:*:*:*:*:*:*:*:*

History

07 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) ChurchCRM es un sistema de gestión de iglesias de código abierto. Antes de la versión 6.5.0, existe una vulnerabilidad de inyección SQL en el archivo 'EventEditor.php'. Al crear un nuevo evento y seleccionar un tipo de evento, el parámetro POST 'EN_tyid' no se sanea. Esto permite a un usuario autenticado con permisos de gestión de eventos ('isAddEvent') ejecutar consultas SQL arbitrarias. La versión 6.5.0 corrige el problema.

Information

Published : 2025-12-16 01:15

Updated : 2026-10-07 19:10

NVD link : CVE-2025-67751

Mitre link : CVE-2025-67751

CVE.ORG link : CVE-2025-67751

JSON object : View

Products Affected

churchcrm

churchcrm

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2025-67751", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-67751", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-12-16T20:52:04.903800Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "ChurchCRM", "product": "CRM", "versions": [{"status": "affected", "version": "< 6.5.0"}]}]}], "published": "2025-12-16T01:15:53.090", "references": [{"url": "https://github.com/ChurchCRM/CRM/commit/2d6cf7aed9af1b9b47e125d1a2266f8e2a88f3fd", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/ChurchCRM/CRM/security/advisories/GHSA-wxcc-gvfv-56fg", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "ChurchCRM is an open-source church management system. Prior to version 6.5.0, a SQL injection vulnerability exists in the `EventEditor.php` file. When creating a new event and selecting an event type, the `EN_tyid` POST parameter is not sanitized. This allows an authenticated user with event management permissions (`isAddEvent`) to execute arbitrary SQL queries. Version 6.5.0 fixes the issue."}, {"lang": "es", "value": "ChurchCRM es un sistema de gesti\u00f3n de iglesias de c\u00f3digo abierto. Antes de la versi\u00f3n 6.5.0, existe una vulnerabilidad de inyecci\u00f3n SQL en el archivo 'EventEditor.php'. Al crear un nuevo evento y seleccionar un tipo de evento, el par\u00e1metro POST 'EN_tyid' no se sanea. Esto permite a un usuario autenticado con permisos de gesti\u00f3n de eventos ('isAddEvent') ejecutar consultas SQL arbitrarias. La versi\u00f3n 6.5.0 corrige el problema."}], "lastModified": "2026-10-07T19:10:00.160", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:churchcrm:churchcrm:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5A5441D8-981B-4308-AEF6-C0164766EA04", "versionEndExcluding": "6.5.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}