Executive brief
EcclesiaCRM, a management platform for churches, contains a security flaw that allows attackers to manipulate database queries. By exploiting this vulnerability, an attacker can gain unauthorized access to sensitive information, including member personal data, financial records, and administrative credentials. This could lead to a total compromise of the church's database and operations.
Technical details
A SQL injection vulnerability exists in EcclesiaCRM prior to version 8.0.0 within the 'v2/templates/query/queryview.php' component. The root cause is the 'ValidateInput' function failing to sanitize raw POST data from the 'custom' and 'value' parameters, which are then directly inserted into SQL query templates using string substitution via 'str_replace'. While some advisories suggest authentication is required to access the Query Viewer, the NVD and CISA-ADP assessments assign a CVSS score of 9.8 (Unauthenticated), indicating a high risk of remote exploitation. Attackers can use UNION-based injection to exfiltrate the entire database, including the 'user_usr' table. The vulnerability is addressed in version 8.0.0 by implementing better input handling and removing verbose SQL debugging comments.
Affected products
- phili67 EcclesiaCRM < 8.0.0
Timeline
- 2026-03-27: disclosed: Vulnerability discovered by researcher Nicolas Pauferro
- 2026-03-29: patched: Fix committed to the main repository branch
- 2026-04-01: advisory: Vendor security advisory published (GHSA-gjw3-73q9-v2qh)
- 2026-04-06: disclosed: CVE-2026-35184 published to NVD