Executive brief
ChurchCRM, an open-source church management system, contains a security flaw in its event type editor. An authorized administrator can execute unauthorized database commands by submitting specially crafted data. This could lead to the theft of sensitive member data, full database deletion, or potential takeover of the underlying server.
Technical details
A SQL injection vulnerability exists in ChurchCRM's 'EditEventTypes.php' component due to improper neutralization of the 'EN_tyid' POST parameter. The application directly concatenates this parameter into a SQL query string without sanitization or prepared statements. While the exploit requires administrative privileges, a successful attack allows for arbitrary SQL execution against the backend database. This can result in full data exfiltration, unauthorized modification of records, or potential remote code execution via database features like 'INTO OUTFILE'. The issue is resolved in version 7.1.0.
Affected products
- ChurchCRM CRM < 7.1.0
Timeline
- 2026-04-05: advisory: GitHub Security Advisory published
- 2026-04-07: disclosed: CVE-2026-39343 published to NVD
- 2026-04-07: patched: Fix released in version 7.1.0