CVE-2023-24684
📋 TL;DR
ChurchCRM versions 4.5.3 and below contain a SQL injection vulnerability in the GetText.php file via the EID parameter. This allows attackers to execute arbitrary SQL commands on the database. All ChurchCRM installations running vulnerable versions are affected.
💻 Affected Systems
- ChurchCRM
📦 What is this software?
Churchcrm by Churchcrm
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data manipulation, authentication bypass, and potential remote code execution through database functions.
Likely Case
Unauthorized data access, extraction of sensitive information (user credentials, personal data), and potential privilege escalation.
If Mitigated
Limited impact with proper input validation, parameterized queries, and database permission restrictions in place.
🎯 Exploit Status
SQL injection via GET parameter is straightforward to exploit. Public proof-of-concept exists in the referenced advisory.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.5.4 or later
Vendor Advisory: https://github.com/ChurchCRM/CRM
Restart Required: No
Instructions:
1. Backup your ChurchCRM database and files. 2. Download the latest version from the official GitHub repository. 3. Replace the vulnerable GetText.php file with the patched version. 4. Verify the fix by testing the EID parameter functionality.
🔧 Temporary Workarounds
Input Validation Filter
allAdd input validation to sanitize the EID parameter before processing
Modify GetText.php to validate EID parameter as integer: if(!is_numeric($_GET['EID'])) { die('Invalid input'); }
Web Application Firewall Rule
allBlock SQL injection patterns in the EID parameter
Add WAF rule to block requests containing SQL keywords in EID parameter: 'SELECT', 'UNION', 'INSERT', 'UPDATE', 'DELETE', 'DROP', '--', '#'
🧯 If You Can't Patch
- Implement strict input validation for all user inputs, particularly the EID parameter
- Restrict database user permissions to minimum required privileges
- Deploy a web application firewall with SQL injection protection rules
- Monitor logs for suspicious SQL queries or error messages
🔍 How to Verify
Check if Vulnerable:
Test the GetText.php endpoint with SQL injection payloads in the EID parameter, such as: /GetText.php?EID=1' OR '1'='1Check Version:
Check ChurchCRM version in the admin dashboard or review the version.php fileVerify Fix Applied:
Test with the same SQL injection payloads and verify they are rejected or properly sanitized without executing SQL commands📡 Detection & Monitoring
Log Indicators:
- SQL syntax errors in application logs
- Unusual database queries from web server IP
- Multiple failed parameter validation attempts
Network Indicators:
- HTTP requests with SQL keywords in EID parameter
- Abnormal response patterns from GetText.php endpoint
SIEM Query:
source="web_logs" AND uri="/GetText.php" AND (query="*SELECT*" OR query="*UNION*" OR query="*OR '1'='1*")