CVE-2023-38763

MediumCVSS 6.5

Published: 08/08/2023(UTC)Updated: 17/06/2026(UTC)Translated: 19/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.66%

47th percentile - higher than 47% of all known CVEs

Summary

Version 5.0.0 of ChurchCRM contains an SQL injection vulnerability that allows a remote attacker to obtain sensitive information via the FundRaiserID parameter within the /FundRaiserEditor.php endpoint.

Risk Assessment

This vulnerability could lead to the exposure of sensitive data, posing a significant security risk to the organization.

Recommendation

It is recommended to upgrade to the latest version of ChurchCRM and to monitor logs for potential attack attempts.

Original NVD description (English source)

SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the FundRaiserID parameter within the /FundRaiserEditor.php endpoint.