A time-based blind SQL injection exists in the PropertyAssign.php endpoint of ChurchCRM. The flaw allows an attacker possessing authenticated access with Edit Records or Manage Groups permissions to execute arbitrary SQL statements. As a result, credentials, personal identifiable information, and configuration secrets can be read or altered, leading to potential data breach and system compromise.

ChurchCRM versions prior to 7.1.0 are affected. Users running the open-source church management system who have the Edit Records or Manage Groups role can exploit the vulnerability. The vulnerability exists in the PropertyAssign.php module, which handles property assignments within the application.

The CVSS score of 8.1 indicates high severity, and while EPSS data is unavailable, the absence in KEV suggests it has not been widely exploited yet. The flaw requires authenticated privileged users; therefore, internal threat actors or compromised accounts pose the primary risk. Exploitation requires a timing attack and careful observation of response delays, which can be difficult for automated attacks but not impossible for an attacker experienced with blind SQL injection.