CVE-2024-25893
📋 TL;DR
ChurchCRM 5.5.0 contains a blind SQL injection vulnerability in FRCertificates.php via the CurrentFundraiser GET parameter. This allows attackers to execute arbitrary SQL queries and potentially extract sensitive database information. All users running the vulnerable version are affected.
💻 Affected Systems
- ChurchCRM
📦 What is this software?
Churchcrm by Churchcrm
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including extraction of user credentials, personal data, financial records, and potential remote code execution through database functions.
Likely Case
Data exfiltration of sensitive information from the database including user data, financial records, and system configuration.
If Mitigated
Limited information disclosure if database permissions are properly restricted and input validation is implemented elsewhere.
🎯 Exploit Status
Time-based blind SQL injection requires no authentication and can be automated with tools like sqlmap.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.5.1 or later
Vendor Advisory: https://github.com/ChurchCRM/CRM/issues/6856
Restart Required: No
Instructions:
1. Backup your ChurchCRM installation and database. 2. Download the latest version from the official repository. 3. Replace the vulnerable files with patched versions. 4. Verify the fix by testing the vulnerable endpoint.
🔧 Temporary Workarounds
Web Application Firewall (WAF)
allImplement WAF rules to block SQL injection patterns targeting the CurrentFundraiser parameter.
Input Validation Filter
allAdd server-side validation to sanitize the CurrentFundraiser parameter before processing.
🧯 If You Can't Patch
- Restrict access to the FRCertificates.php endpoint using IP whitelisting or authentication requirements.
- Implement database-level controls to limit query execution permissions for the application user.
🔍 How to Verify
Check if Vulnerable:
Test the FRCertificates.php endpoint with time-based SQL injection payloads in the CurrentFundraiser parameter.Check Version:
Check the ChurchCRM version in the admin panel or review the software version files.Verify Fix Applied:
Attempt the same SQL injection tests after patching; successful queries should no longer cause time delays.📡 Detection & Monitoring
Log Indicators:
- Unusual long-duration requests to FRCertificates.php
- SQL error messages in application logs
- Multiple requests with SQL-like patterns in parameters
Network Indicators:
- HTTP requests with SQL injection patterns in GET parameters
- Unusual timing patterns in requests to the vulnerable endpoint
SIEM Query:
source="web_logs" AND uri="/FRCertificates.php" AND (param="CurrentFundraiser" AND value MATCHES "(?i)(sleep|benchmark|waitfor)")