CVE-2023-29842
📋 TL;DR
ChurchCRM 4.5.4 contains a blind SQL injection vulnerability in the EditEventTypes.php endpoint via the EN_tyid POST parameter. Attackers can exploit this to extract database information through time-based techniques. Organizations running ChurchCRM 4.5.4 are affected.
💻 Affected Systems
- ChurchCRM
📦 What is this software?
Churchcrm by Churchcrm
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including sensitive user data, authentication credentials, and potential privilege escalation to execute arbitrary commands.
Likely Case
Data exfiltration from the ChurchCRM database including user information, event details, and potentially authentication hashes.
If Mitigated
Limited information disclosure if proper input validation and WAF rules are in place.
🎯 Exploit Status
Exploit requires authentication to access the vulnerable endpoint. Public proof-of-concept scripts are available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.5.5 or later
Vendor Advisory: https://github.com/ChurchCRM/CRM
Restart Required: No
Instructions:
1. Backup your ChurchCRM installation and database. 2. Download the latest version from GitHub. 3. Replace the vulnerable files with patched versions. 4. Verify the fix by testing the vulnerable endpoint.
🔧 Temporary Workarounds
WAF Rule Implementation
allImplement web application firewall rules to block SQL injection patterns targeting the EN_tyid parameter.
Endpoint Restriction
allRestrict access to /EditEventTypes.php endpoint to authorized administrators only.
🧯 If You Can't Patch
- Implement strict input validation for the EN_tyid parameter to only accept expected data types.
- Disable or remove the EditEventTypes.php endpoint if not required for operations.
🔍 How to Verify
Check if Vulnerable:
Test the /EditEventTypes.php endpoint with time-based SQL injection payloads in the EN_tyid parameter and observe response delays.Check Version:
Check the ChurchCRM version in the admin panel or review the software version files.Verify Fix Applied:
Test the patched endpoint with the same payloads and confirm no SQL injection occurs.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /EditEventTypes.php with SQL keywords in parameters
- Multiple failed authentication attempts followed by requests to vulnerable endpoint
Network Indicators:
- HTTP POST requests containing SQL injection patterns like SLEEP(), BENCHMARK(), or WAITFOR DELAY
SIEM Query:
source="web_logs" AND uri_path="/EditEventTypes.php" AND (param="EN_tyid" AND value MATCHES "(?i)(sleep|benchmark|waitfor|union|select)")🔗 References
- http://packetstormsecurity.com/files/175105/ChurchCRM-4.5.4-SQL-Injection.html
- https://github.com/ChurchCRM/CRM
- https://github.com/arvandy/CVE/blob/main/CVE-2023-29842/CVE-2023-29842.md
- https://github.com/arvandy/CVE/blob/main/CVE-2023-29842/CVE-2023-29842.py
- http://packetstormsecurity.com/files/175105/ChurchCRM-4.5.4-SQL-Injection.html
- https://github.com/ChurchCRM/CRM
- https://github.com/arvandy/CVE/blob/main/CVE-2023-29842/CVE-2023-29842.md
- https://github.com/arvandy/CVE/blob/main/CVE-2023-29842/CVE-2023-29842.py
