A SQL injection flaw lives in ChurchCRM’s /PaddleNumEditor.php endpoint in versions earlier than 6.7.2. Any authenticated user, even if granted no permissions, can supply a crafted PerID parameter that is concatenated directly into a database query. This omission of input sanitization can permit the attacker to execute arbitrary SQL statements against the application’s database, potentially allowing unauthorized disclosure, alteration, or deletion of church data.

The vulnerability affects the ChurchCRM product for all releases prior to version 6.7.2. Users running earlier builds of the CRM must review the upgrade path, as the patch is included starting with release 6.7.2.

The CVSS score of 8.8 signals high severity, while the EPSS value of less than 1% indicates the likelihood of exploitation is currently very low. The report is not listed in the CISA KEV catalog, so no public exploits are known. However, the flaw requires authentication; once an attacker has valid credentials, they can directly target the vulnerable endpoint with a malicious PerID payload, potentially compromising the entire database.