PT-2026-33526 · Churchcrm · Churchcrm
CVE-2026-40482
·
Published
2026-04-17
·
Updated
2026-04-18
CVSS v4.0
7.1
High
| Vector | AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
ChurchCRM versions prior to 7.2.0
Description
An issue exists in the open-source church management system where unsanitized input in the
$routeAndAccount variable is concatenated into raw SQL within the getMemberByScanString() function of the FinancialService class, leading to SQL injection.Recommendations
Update to version 7.2.0.
As a temporary workaround, consider restricting access to the
getMemberByScanString() function until the update is applied.Exploit
Fix
SQL injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Churchcrm