ChurchCRM v.5.0.0 vulnerabilities

In version 5.0.0 of ChurchCRM, there is an SQL injection vulnerability that allows a remote attacker to obtain sensitive information via the volopp1 and volopp2 parameters within /QueryView.php.

SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the volopp parameter within /QueryView.php.

The SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the group parameter within /QueryView.php.

The SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to access sensitive information via the searchstring and searchwhat parameters within /QueryView.php.

SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the PropertyID parameter within /QueryView.php.

ChurchCRM version 5.0.0 has an SQL injection vulnerability that allows a remote attacker to obtain sensitive information via the 'value' and 'custom' parameters within /QueryView.php.

The SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to access sensitive information via the membermonth parameter within /QueryView.php.

ChurchCRM version 5.0.0 has an SQL injection vulnerability that allows a remote attacker to obtain sensitive information via the birthmonth and percls parameters within /QueryView.php.

Version 5.0.0 of ChurchCRM contains an SQL injection vulnerability that allows a remote attacker to obtain sensitive information via the FundRaiserID parameter within the /FundRaiserEditor.php endpoint.

Version 5.0.0 of ChurchCRM has an SQL injection vulnerability that allows a remote attacker to obtain sensitive information via the friendmonths parameter in /QueryView.php.