ChurchCRM vulnerabilities

ChurchCRM is an open-source church management system. Prior to version 7.3.2, an attacker could exploit top-level GET navigation from an external page to FundRaiserDelete.php, PropertyTypeDelete.php, or NoteDelete.php, allowing a logged-in user with the relevant role to silently delete records.

ChurchCRM before version 7.2.0 has an SQL injection vulnerability in FinancialService::getMemberByScanString() due to unsanitized $routeAndAccount concatenated into raw SQL. This issue has been fixed in version 7.2.0.

ChurchCRM before version 7.2.0 has an object-level authorization vulnerability in the GET /api/person/{personId} endpoint. Any authenticated user with only EditSelf privileges can enumerate and read other members' records, exposing sensitive PII including names, addresses, phone numbers, and email addresses.

In ChurchCRM prior to version 7.4.0, an authenticated administrator can achieve Remote Code Execution (RCE) on the server by installing a malicious plugin ZIP archive containing a PHP webshell. The application explicitly includes 'php' in its ALLOWED_EXTENSIONS list, while the dangerous extensions denylist fails to block standard .php files, allowing direct code execution via HTTP after extraction in the web root.

ChurchCRM is an open-source church management system. In versions 7.2.0 to 7.2.2, the fix for CVE-2026-4058 is incomplete, allowing for exploitation of this vulnerability.

ChurchCRM is an open-source church management system. In versions prior to 7.3.2, the fix for CVE-2026-39337 is incomplete, allowing for pre-authentication remote code execution via unsanitized DB_PASSWORD.

In ChurchCRM before 7.2.0, the /api/public/user/login endpoint validates only username and password, bypassing account lockout and two-factor authentication. An attacker with knowledge of a password can obtain API access even when the account is locked or 2FA is enabled.

ChurchCRM before version 6.5.3 contains a SQL injection vulnerability in the Event Attendee Editor. An authenticated user can execute arbitrary SQL commands, leading to complete database compromise, administrative credential theft, and potential system takeover. Attackers can extract sensitive member data, credentials, and financial information. Version 6.5.3 includes a patch.

ChurchCRM before version 6.5.3 may disclose database information in error messages, including host, IP, username, and password. Version 6.5.3 fixes the issue.

ChurchCRM before version 6.5.3 in the Database Restore functionality does not validate the content or file extension of uploaded files. An attacker can upload a web shell file and subsequently upload a .htaccess file to enable direct access. Once accessed, the web shell allows remote code execution (RCE) on the server. Version 6.5.3 fixes the issue.

ChurchCRM before version 5.21.0 contains a pre-authentication remote code execution vulnerability in the setup wizard. An unauthenticated attacker can inject arbitrary PHP code during the installation process, leading to complete server compromise. The issue arises from directly concatenating user input from the setup form into a PHP configuration template without validation.

ChurchCRM before version 7.4.0 has XSS vulnerabilities due to insufficient output encoding of user-controlled parameter names and values. An attacker can reflect malicious script into JavaScript or HTML contexts.

In ChurchCRM prior to version 7.4.0, an authorization flaw in family-scoped endpoints allowed low-privileged users to read and modify other families' records. An authenticated non-admin user with EditSelf access can supply another family's familyId and access records outside their own family scope. The backend trusts the attacker-controlled familyId and loads the corresponding family entity without verifying that the requested family belongs to the current user.

In ChurchCRM prior to version 7.4.0, a low-privileged user can bypass the /admin/export UI and exfiltrate the entire member directory. The POST /CSVCreateFile.php endpoint generates and streams a CSV containing the full Personally Identifiable Information (PII) of every Person/Family record in the database, without performing any feature-level or object-level authorization check beyond the coarse 'has any admin permission' gate inherited from the legacy page bootstrap. In other words, any single non-admin permission flag is enough to reach the CSV bulk-export endpoint, even though such users should not have data export rights. The export script is missing a dedicated isAdmin() (or a new bExportData) authorization check of its own. This issue has been fixed in version 7.4.0.

ChurchCRM before version 7.1.0 has a reflected XSS vulnerability on the login page due to lack of sanitization of the username parameter from the URL. The parameter is directly displayed in the input field, allowing injection of malicious JavaScript that can steal sessions or replace the login form.

In ChurchCRM prior to version 7.1.0, a SQL injection vulnerability exists in the EditEventTypes.php file, accessible only to administrators. The EN_tyid POST parameter is not sanitized before being used in a SQL query, allowing an administrator to execute arbitrary SQL commands. This vulnerability is fixed in version 7.1.0.

SQL injection vulnerability in ChurchCRM before 7.1.0 in the searchwhat parameter via QueryView.php with QueryID=15. Authenticated users with proper permissions can inject SQL queries.

ChurchCRM prior to version 7.1.0 is vulnerable to time-based SQL Injection due to improper input validation. The endpoint Reports/ConfirmReportEmail.php?familyId= does not correctly sanitize user input, and the sanitized input is not used to create the SQL query. This vulnerability is fixed in version 7.1.0.