CVE-2025-1199
📋 TL;DR
This critical SQL injection vulnerability in Best Church Management Software allows remote attackers to execute arbitrary SQL commands by manipulating the 'id' parameter in the /admin/app/role_crud.php file. Attackers can potentially access, modify, or delete database content. All organizations using the vulnerable software version are affected.
💻 Affected Systems
- SourceCodester Best Church Management Software
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data destruction, privilege escalation to administrative access, and potential server takeover via SQL injection to RCE chaining.
Likely Case
Unauthorized access to sensitive church member data, financial records, and administrative credentials stored in the database.
If Mitigated
Limited impact with proper input validation and database permission restrictions, potentially only allowing data viewing without modification.
🎯 Exploit Status
Exploit requires access to the admin interface. The vulnerability is in role management functionality.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.sourcecodester.com/
Restart Required: No
Instructions:
1. Check vendor website for updates. 2. If no patch available, implement workarounds. 3. Consider replacing with alternative software.
🔧 Temporary Workarounds
Input Validation and Sanitization
allAdd parameterized queries or input validation to role_crud.php
Modify role_crud.php to use prepared statements: $stmt = $conn->prepare('SELECT * FROM roles WHERE id = ?'); $stmt->bind_param('i', $id);
Access Restriction
linuxRestrict access to /admin/ directory to trusted IP addresses only
Add to .htaccess: Order Deny,Allow
Deny from all
Allow from 192.168.1.0/24
🧯 If You Can't Patch
- Implement web application firewall (WAF) with SQL injection rules
- Isolate the application in a segmented network with strict outbound filtering
🔍 How to Verify
Check if Vulnerable:
Test the /admin/app/role_crud.php endpoint with SQL injection payloads in the 'id' parameterCheck Version:
Check software version in admin panel or readme filesVerify Fix Applied:
Verify that SQL injection payloads no longer execute and return error messages📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in application logs
- Multiple failed login attempts to admin interface
- Unexpected database queries from web server
Network Indicators:
- HTTP requests to /admin/app/role_crud.php with SQL keywords in parameters
- Unusual database connection patterns from web server
SIEM Query:
source="web_logs" AND uri="/admin/app/role_crud.php" AND (param="id" AND value MATCHES "(?i)(union|select|insert|delete|update|drop|--|#|/*)")