Executive brief
CiviCRM is a widely-used database management system for nonprofits, educational institutions, and service organizations. An SQL injection vulnerability in its contact search feature allows authenticated staff members to bypass access controls and extract sensitive information from the entire database, including donor records, membership data, and personal details. Attackers with staff-level credentials can exfiltrate all database contents without additional exploitation steps.
Technical details
The vulnerability is an SQL injection (SQLi) flaw in the contact search functionality, specifically in the RLIKE clause handling. The vulnerable code concatenates user-supplied input directly into the SQL query without proper parameterization or sanitization. Attack vector is network-based and requires authentication with staff-level privileges; the attacker can craft malicious search queries to execute arbitrary SQL and read unrestricted database contents. The issue affects CiviCRM through version 6.18.alpha1. No patch status or mitigation details are included in the advisory, but the vulnerability can be remediated through input validation, parameterized queries, and escaping of user-supplied values in search operations.
Affected products
- CiviCRM CiviCRM through 6.18.alpha1
Timeline
- 2026-08-11: disclosed