Executive brief
Paroiciel, a software suite used for managing Catholic parish records and pastoral data, contains a security flaw that allows unauthorized individuals to access its database. By sending specially crafted web requests, an attacker can bypass security controls to view sensitive information, including database structures and potentially personal records. This could lead to the exposure of private community data and compromise the confidentiality of parish operations.
Technical details
A SQL injection vulnerability exists in Paroiciel version 11.20 and potentially earlier versions due to improper neutralization of special elements in several PHP endpoints. Specifically, the 'tRecIdListe' parameter in trec.php, the 'zProIdPro' parameter in zpro.php, and the 'eGeqIdEquipe' parameter in egeq.php are susceptible to manipulation via GET requests. An unauthenticated remote attacker can exploit these flaws by submitting crafted SQL payloads to execute arbitrary queries. This allows for the extraction of database schema information, table names, column names, and sensitive data stored within the database. While the vendor has released newer versions (e.g., 11.30), users should verify they are running a version that addresses these specific injection points.
Affected products
- Paroiciel Association Paroiciel 11.20 and earlier
Timeline
- 2018-11-09: disclosed: Initial discovery and proof of concept by researcher
- 2018-11-12: other: Exploit published on Exploit-DB
- 2026-06-01: advisory: CVE formally published and assigned by VulnCheck