Executive brief
EcclesiaCRM, an open-source church management system, contains a security flaw in its query management interface. An attacker with basic user permissions can execute unauthorized database commands, potentially allowing them to steal sensitive member data, modify financial records, or delete entire database tables. This issue exists because the software fails to properly clean user-provided information before using it in database searches.
Technical details
A SQL injection vulnerability exists in EcclesiaCRM versions 8.0.0 and earlier within the `ValidateInput()` function of the query view component (`src/v2/templates/query/queryview.php`). The root cause is a failure to sanitize user-supplied POST parameters in the function's default case, which are subsequently inserted into SQL queries using `str_replace` instead of parameterized queries. An authenticated attacker can exploit this by providing malicious input for query parameters that use non-standard validation types. This vulnerability is an incomplete fix for a previous issue (CVE-2026-35184). A patch has been released in commit `f743b97f89da469a4c70b82bd61d0a59a3a957a9` which applies `LegacyFilterInput()` to the default case, though the use of string replacement remains.
Affected products
- phili67 EcclesiaCRM <= 8.0.0
Timeline
- 2026-04-29: advisory: GitHub Security Advisory published
- 2026-05-13: disclosed: CVE published to NVD