CVE-2023-38769
📋 TL;DR
This SQL injection vulnerability in ChurchCRM v5.0.0 allows remote attackers to execute arbitrary SQL commands via the searchstring and searchwhat parameters in QueryView.php. This can lead to unauthorized access to sensitive database information. All ChurchCRM v5.0.0 installations with QueryView.php accessible are affected.
💻 Affected Systems
- ChurchCRM
📦 What is this software?
Churchcrm by Churchcrm
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including extraction of all user credentials, personal data, financial records, and potential system takeover via subsequent attacks.
Likely Case
Unauthorized access to sensitive user data, configuration information, and potential privilege escalation within the application.
If Mitigated
Limited or no data exposure if proper input validation and parameterized queries are implemented.
🎯 Exploit Status
SQL injection via GET parameters is well-understood and easily weaponized. Public disclosure includes technical details.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v5.0.1 or later
Vendor Advisory: https://github.com/ChurchCRM/CRM/wiki
Restart Required: No
Instructions:
1. Backup your ChurchCRM database and files. 2. Download the latest version from ChurchCRM repository. 3. Replace vulnerable files with patched versions. 4. Verify QueryView.php uses parameterized queries.
🔧 Temporary Workarounds
Web Application Firewall Rule
allBlock or sanitize SQL injection patterns in searchstring and searchwhat parameters
WAF specific - configure rules to block SQL injection patterns in GET parameters
Access Restriction
linuxRestrict access to QueryView.php endpoint
# Apache: RewriteRule ^QueryView\.php$ - [F]
# Nginx: location ~ QueryView\.php { deny all; }
🧯 If You Can't Patch
- Implement strict input validation for searchstring and searchwhat parameters
- Deploy a web application firewall with SQL injection protection rules
🔍 How to Verify
Check if Vulnerable:
Test QueryView.php with SQL injection payloads in searchstring/searchwhat parameters: ?searchstring=test' OR '1'='1Check Version:
Check ChurchCRM version in admin panel or via git describe --tagsVerify Fix Applied:
Verify QueryView.php no longer executes SQL injection payloads and returns proper error handling📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in application logs
- Multiple failed query attempts with special characters
- Access to QueryView.php with suspicious parameters
Network Indicators:
- HTTP requests to QueryView.php containing SQL keywords in parameters
- Unusual database query patterns from web server
SIEM Query:
web.url="*QueryView.php*" AND (web.param="*searchstring*" OR web.param="*searchwhat*") AND web.param="*' OR *"