CVE-2026-39318

ChurchCRM is an open-source church management system. Versions prior to 7.1.0 have an SQL injection vulnerability in the endpoints `/GroupPropsFormRowOps.php`, `/PersonCustomFieldsRowOps.php`, and `/FamilyCustomFieldsRowOps.php`. A user has to be authenticated. For `ManageGroups` privileges have to be enabled and for the other two endpoints the attack has to be executed by an administrative user. These users can inject arbitrary SQL statements through the `Field` parameter and thus modify tables from the database. This vulnerability is fixed in 7.1.0.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/ChurchCRM/CRM/security/advisories/GHSA-8r53-w4r6-w62c	Not Applicable
https://github.com/ChurchCRM/CRM/security/advisories/GHSA-j3vj-59vv-h4rc	Exploit Vendor Advisory
https://github.com/ChurchCRM/CRM/security/advisories/GHSA-j3vj-59vv-h4rc	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:churchcrm:churchcrm:*:*:*:*:*:*:*:*

History

26 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) ChurchCRM es un sistema de gestión de iglesias de código abierto. Antes de 7.1.0, el archivo GroupPropsFormRowOps.php contiene una vulnerabilidad de inyección SQL. La entrada del usuario en el parámetro Field se inserta directamente en consultas SQL sin una sanitización adecuada. La función mysqli_real_escape_string() no escapa los caracteres de acento grave, lo que permite a los atacantes salir del contexto de identificador SQL y ejecutar sentencias SQL arbitrarias. Esta vulnerabilidad está corregida en 7.1.0.

Information

Published : 2026-04-07 18:16

Updated : 2026-10-26 22:10

NVD link : CVE-2026-39318

Mitre link : CVE-2026-39318

CVE.ORG link : CVE-2026-39318

JSON object : View

Products Affected

churchcrm

churchcrm

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2026-39318", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-39318", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-08T18:46:28.790516Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "ChurchCRM", "product": "CRM", "versions": [{"status": "affected", "version": "< 7.1.0"}]}]}], "published": "2026-04-07T18:16:42.810", "references": [{"url": "https://github.com/ChurchCRM/CRM/security/advisories/GHSA-8r53-w4r6-w62c", "tags": ["Not Applicable"], "source": "security-advisories@github.com"}, {"url": "https://github.com/ChurchCRM/CRM/security/advisories/GHSA-j3vj-59vv-h4rc", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/ChurchCRM/CRM/security/advisories/GHSA-j3vj-59vv-h4rc", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "ChurchCRM is an open-source church management system. Versions prior to 7.1.0 have an SQL injection vulnerability in the endpoints `/GroupPropsFormRowOps.php`, `/PersonCustomFieldsRowOps.php`, and `/FamilyCustomFieldsRowOps.php`. A user has to be authenticated. For `ManageGroups` privileges have to be enabled and for the other two endpoints the attack has to be executed by an administrative user. These users can inject arbitrary SQL statements through the `Field` parameter and thus modify tables from the database. This vulnerability is fixed in 7.1.0."}, {"lang": "es", "value": "ChurchCRM es un sistema de gesti\u00f3n de iglesias de c\u00f3digo abierto. Antes de 7.1.0, el archivo GroupPropsFormRowOps.php contiene una vulnerabilidad de inyecci\u00f3n SQL. La entrada del usuario en el par\u00e1metro Field se inserta directamente en consultas SQL sin una sanitizaci\u00f3n adecuada. La funci\u00f3n mysqli_real_escape_string() no escapa los caracteres de acento grave, lo que permite a los atacantes salir del contexto de identificador SQL y ejecutar sentencias SQL arbitrarias. Esta vulnerabilidad est\u00e1 corregida en 7.1.0."}], "lastModified": "2026-10-26T22:10:00.163", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:churchcrm:churchcrm:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7DD42DAF-385C-4BEB-B5B9-50838CEA9D2E", "versionEndIncluding": "7.0.5"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}