CVE-2025-66313
📋 TL;DR
ChurchCRM versions 6.2.0 and earlier contain a time-based blind SQL injection vulnerability in the 1FieldSec parameter handling. This allows attackers to extract sensitive database information or modify data through blind injection techniques. All ChurchCRM installations running vulnerable versions are affected.
💻 Affected Systems
- ChurchCRM
📦 What is this software?
Churchcrm by Churchcrm
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including exfiltration of sensitive personal data (member information, financial records, credentials) and potential system takeover.
Likely Case
Data exfiltration of church member information, financial records, and user credentials through blind SQL injection techniques.
If Mitigated
Limited impact with proper input validation and parameterized queries preventing successful exploitation.
🎯 Exploit Status
Time-based blind SQL injection requires specialized tools but is well-documented and automated tools exist.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after commit 719a6bc73245c40e3c30dae6229daaecd451e59f
Vendor Advisory: https://github.com/ChurchCRM/CRM/security/advisories/GHSA-47q3-c874-mqvp
Restart Required: Yes
Instructions:
1. Backup your ChurchCRM database and files. 2. Update to the latest ChurchCRM version. 3. Apply the specific commit 719a6bc73245c40e3c30dae6229daaecd451e59f if not updating fully. 4. Restart the web server.
🔧 Temporary Workarounds
Input Validation Filter
allImplement strict input validation for the 1FieldSec parameter to reject SQL injection patterns
Web Application Firewall
allDeploy WAF with SQL injection protection rules to block exploitation attempts
🧯 If You Can't Patch
- Implement network segmentation to isolate ChurchCRM from sensitive systems
- Deploy database activity monitoring to detect SQL injection attempts
🔍 How to Verify
Check if Vulnerable:
Check ChurchCRM version in admin panel or via version.php file. If version is 6.2.0 or earlier, system is vulnerable.Check Version:
Check /path/to/churchcrm/version.php or admin panel version displayVerify Fix Applied:
Verify ChurchCRM version is updated beyond 6.2.0 and confirm commit 719a6bc73245c40e3c30dae6229daaecd451e59f is applied.📡 Detection & Monitoring
Log Indicators:
- Unusual database query patterns
- Multiple requests with SLEEP() or similar SQL functions in parameters
- Long response times from specific endpoints
Network Indicators:
- Repeated requests to endpoints with SQL injection payloads in 1FieldSec parameter
- Unusual traffic patterns to ChurchCRM database ports
SIEM Query:
source="web_logs" AND uri="*1FieldSec*" AND (payload="*SLEEP*" OR payload="*WAITFOR*" OR payload="*BENCHMARK*")