CVE-2023-38764
📋 TL;DR
CVE-2023-38764 is an SQL injection vulnerability in ChurchCRM v5.0.0 that allows remote attackers to extract sensitive database information by manipulating birthmonth and percls parameters in QueryView.php. This affects all ChurchCRM v5.0.0 installations with the vulnerable endpoint exposed. Attackers can potentially access personal data, user credentials, and other sensitive information stored in the database.
💻 Affected Systems
- ChurchCRM
📦 What is this software?
Churchcrm by Churchcrm
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including extraction of all user data, credentials, financial information, and potential privilege escalation to administrative access.
Likely Case
Extraction of sensitive personal information (names, addresses, contact details, donation records) and potential credential harvesting from database tables.
If Mitigated
Limited information disclosure from non-sensitive tables if proper input validation and WAF rules are in place.
🎯 Exploit Status
Exploitation requires at least basic user authentication. SQL injection techniques are well-documented and automated tools can be adapted for this vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v5.0.1 or later
Vendor Advisory: https://github.com/ChurchCRM/CRM/wiki/Security-Advisories
Restart Required: No
Instructions:
1. Backup your ChurchCRM database and files. 2. Download latest version from ChurchCRM GitHub releases. 3. Replace existing installation files with patched version. 4. Verify QueryView.php has proper parameter sanitization.
🔧 Temporary Workarounds
Input Validation Filter
allAdd server-side validation for birthmonth and percls parameters to only accept expected values
Modify QueryView.php to validate parameters before SQL execution
WAF Rule
allImplement web application firewall rules to block SQL injection patterns in QueryView.php parameters
Add WAF rule: Detect SQL keywords in birthmonth/percls parameters
🧯 If You Can't Patch
- Restrict access to QueryView.php endpoint using IP whitelisting or authentication requirements
- Implement database-level protections: Use prepared statements, parameterized queries, and minimal database user privileges
🔍 How to Verify
Check if Vulnerable:
Test QueryView.php with SQL injection payloads in birthmonth parameter: ?birthmonth=1' OR '1'='1Check Version:
Check ChurchCRM version in admin panel or via /api/system/version endpointVerify Fix Applied:
Verify QueryView.php uses parameterized queries and proper input validation for birthmonth/percls parameters📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed parameter validation attempts in QueryView.php
- Unexpected database error messages in web logs
Network Indicators:
- HTTP requests to QueryView.php with SQL keywords in parameters
- Unusual database connection patterns from web server
SIEM Query:
source=web_logs AND uri="/QueryView.php" AND (param="birthmonth" OR param="percls") AND (query="UNION" OR query="SELECT" OR query="OR '1'='1'")