CVE-2021-41965
📋 TL;DR
This SQL injection vulnerability in ChurchCRM allows authenticated attackers to execute arbitrary SQL commands through unsanitized input fields (EN_tyid, theID, EID) during edit operations. It affects ChurchCRM versions 2.0.0 through 4.4.5, potentially compromising the entire database. Any organization using vulnerable ChurchCRM versions with authenticated user access is at risk.
💻 Affected Systems
- ChurchCRM
📦 What is this software?
Churchcrm by Churchcrm
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data manipulation, privilege escalation, and potential remote code execution via database functions.
Likely Case
Data exfiltration of sensitive church member information, financial records, and personal data; potential unauthorized access to administrative functions.
If Mitigated
Limited impact due to proper input validation, parameterized queries, and database user privilege restrictions.
🎯 Exploit Status
Exploitation requires authenticated access; SQL injection is straightforward once authenticated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.4.6 and later
Vendor Advisory: https://github.com/ChurchCRM/CRM/releases
Restart Required: No
Instructions:
1. Backup your ChurchCRM database and files. 2. Download ChurchCRM version 4.4.6 or later from the official repository. 3. Replace the existing installation with the updated version. 4. Verify the update completed successfully.
🔧 Temporary Workarounds
Input Validation Filter
allImplement server-side input validation for EN_tyid, theID, and EID parameters to reject non-numeric values
Web Application Firewall Rules
allDeploy WAF rules to block SQL injection patterns in POST/PUT requests to edit endpoints
🧯 If You Can't Patch
- Implement strict database user privilege separation: ensure ChurchCRM database user has only necessary permissions
- Deploy network segmentation: isolate ChurchCRM server from other critical systems and implement strict firewall rules
🔍 How to Verify
Check if Vulnerable:
Check ChurchCRM version in admin panel or via version file; if version is between 2.0.0 and 4.4.5 inclusive, system is vulnerable.Check Version:
Check /Include/Version.php file or admin dashboard for version informationVerify Fix Applied:
Confirm ChurchCRM version is 4.4.6 or later; test edit functionality with malformed input to ensure proper error handling.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in application logs
- Multiple failed edit attempts with malformed parameters
- Database queries containing unusual patterns or UNION statements
Network Indicators:
- HTTP POST/PUT requests to edit endpoints containing SQL keywords in parameters
- Unusual database connection patterns from application server
SIEM Query:
source="churchcrm.logs" AND ("SQL syntax" OR "UNION" OR "SELECT *" OR "DROP TABLE")