CVE-2022-31325
📋 TL;DR
This SQL injection vulnerability in ChurchCRM 4.4.5 allows attackers to execute arbitrary SQL commands via the PersonID parameter in WhyCameEditor.php. This affects all ChurchCRM 4.4.5 installations with the vulnerable endpoint accessible. Attackers could potentially read, modify, or delete database contents.
💻 Affected Systems
- ChurchCRM
📦 What is this software?
Churchcrm by Churchcrm
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including sensitive personal data exposure, authentication bypass, and potential remote code execution if database functions allow it.
Likely Case
Unauthorized data access and extraction of sensitive church member information, donation records, and personal details.
If Mitigated
Limited impact with proper input validation and parameterized queries preventing SQL injection.
🎯 Exploit Status
Exploit requires authentication to access WhyCameEditor.php, but SQL injection payloads are publicly documented.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.4.6 or later
Vendor Advisory: https://github.com/ChurchCRM/CRM/issues/6005
Restart Required: No
Instructions:
1. Backup your ChurchCRM database and files. 2. Download ChurchCRM 4.4.6 or later from the official repository. 3. Replace the vulnerable WhyCameEditor.php file with the patched version. 4. Verify the fix by testing the PersonID parameter.
🔧 Temporary Workarounds
Input Validation Filter
allAdd input validation to ensure PersonID only accepts numeric values
Modify WhyCameEditor.php to include: if(!is_numeric($_GET['PersonID'])) { die('Invalid input'); }
WAF Rule
allImplement web application firewall rules to block SQL injection patterns
Add WAF rule: SecRule ARGS:PersonID "@rx (\'|\"|--|#|;|union|select|insert|update|delete|drop|create|alter)" "id:1001,phase:2,deny"
🧯 If You Can't Patch
- Restrict access to WhyCameEditor.php using IP whitelisting or authentication requirements
- Implement database user with minimal privileges (read-only if possible) for the application
🔍 How to Verify
Check if Vulnerable:
Test the PersonID parameter with SQL injection payloads like: PersonID=1' OR '1'='1Check Version:
Check ChurchCRM version in admin panel or review version.php fileVerify Fix Applied:
Test the same SQL injection payloads after patching - they should be rejected or properly handled📡 Detection & Monitoring
Log Indicators:
- Unusual SQL errors in application logs
- Multiple failed PersonID parameter attempts with special characters
Network Indicators:
- HTTP requests to WhyCameEditor.php with SQL keywords in parameters
SIEM Query:
source="web_logs" AND uri="/churchcrm/WhyCameEditor.php" AND (query="*union*" OR query="*select*" OR query="*' OR '*" OR query="*;*" OR query="*--*")🔗 References
- http://packetstormsecurity.com/files/167483/ChurchCRM-4.4.5-SQL-Injection.html
- https://github.com/ChurchCRM/CRM/issues/6005
- https://github.com/nu11secur1ty/CVE-mitre/tree/main/2022/CVE-2022-31325
- https://www.nu11secur1ty.com/2022/06/cve-2022-31325.htm
- http://packetstormsecurity.com/files/167483/ChurchCRM-4.4.5-SQL-Injection.html
- https://github.com/ChurchCRM/CRM/issues/6005
- https://github.com/nu11secur1ty/CVE-mitre/tree/main/2022/CVE-2022-31325
- https://www.nu11secur1ty.com/2022/06/cve-2022-31325.htm
