CVE-2023-38762
📋 TL;DR
A SQL injection vulnerability in ChurchCRM v5.0.0 allows remote attackers to extract sensitive database information by manipulating the friendmonths parameter in QueryView.php. This affects all ChurchCRM v5.0.0 installations with the vulnerable component exposed. Attackers can potentially access user data, configuration details, and other sensitive information stored in the database.
💻 Affected Systems
- ChurchCRM
📦 What is this software?
Churchcrm by Churchcrm
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including user credentials, personal information, financial data, and administrative access leading to full system takeover.
Likely Case
Extraction of sensitive user data (names, emails, addresses) and configuration information that could enable further attacks.
If Mitigated
Limited information disclosure if database permissions are properly restricted and input validation is enforced at other layers.
🎯 Exploit Status
SQL injection vulnerabilities are commonly weaponized. The specific parameter and endpoint are documented in CVE disclosures, making exploitation straightforward for attackers with basic SQLi knowledge.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v5.0.1 or later
Vendor Advisory: https://github.com/ChurchCRM/CRM/wiki
Restart Required: No
Instructions:
1. Backup your ChurchCRM database and configuration. 2. Download the latest version from churchcrm.io. 3. Replace the vulnerable QueryView.php file with the patched version. 4. Verify the application functions correctly after update.
🔧 Temporary Workarounds
Input Validation Filter
allAdd server-side validation to sanitize the friendmonths parameter before processing
Modify QueryView.php to add: $friendmonths = filter_var($_GET['friendmonths'], FILTER_SANITIZE_NUMBER_INT);
Access Restriction
allRestrict access to QueryView.php to authenticated users only
Add authentication check at the beginning of QueryView.php: if (!isset($_SESSION['user'])) { header('Location: /login.php'); exit(); }
🧯 If You Can't Patch
- Implement a web application firewall (WAF) with SQL injection rules to block exploitation attempts
- Disable or restrict access to the QueryView.php endpoint through web server configuration
🔍 How to Verify
Check if Vulnerable:
Test by accessing /QueryView.php?friendmonths=1' OR '1'='1 and checking for SQL error messages or unexpected data returnsCheck Version:
Check ChurchCRM version in admin panel or review version.php fileVerify Fix Applied:
Attempt the same SQL injection test after patching - should receive proper error handling or no data leakage📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in application logs
- Multiple requests to QueryView.php with suspicious parameters
- Database queries with unexpected UNION or SELECT statements
Network Indicators:
- HTTP requests containing SQL keywords (UNION, SELECT, OR) in friendmonths parameter
- Abnormal traffic patterns to QueryView.php endpoint
SIEM Query:
source="web_logs" AND uri_path="/QueryView.php" AND (query_string="*friendmonths=*'*" OR query_string="*friendmonths=*%27*")