CVE-2025-68112

Critical

Published: 17/12/2025(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

ChurchCRM before version 6.5.3 contains a SQL injection vulnerability in the Event Attendee Editor. An authenticated user can execute arbitrary SQL commands, leading to complete database compromise, administrative credential theft, and potential system takeover. Attackers can extract sensitive member data, credentials, and financial information. Version 6.5.3 includes a patch.

Risk Assessment

The risk includes complete loss of confidentiality and integrity of data in the church management system, including personal and financial data, and potential system takeover by an attacker.

Recommendation

It is recommended to immediately upgrade ChurchCRM to version 6.5.3 or later to eliminate the SQL injection vulnerability.

Original NVD description (English source)

ChurchCRM is an open-source church management system. In versions prior to 6.5.3, a SQL injection vulnerability in ChurchCRM's Event Attendee Editor allows authenticated users to execute arbitrary SQL commands, leading to complete database compromise, administrative credential theft, and potential system takeover. The vulnerability enables attackers to extract sensitive member data, authentication credentials, and financial information from the church management system. Version 6.5.3 contains a patch for the issue.