An authenticated user holding the ManageGroups role can craft a POST request to MemberRoleChange.php using a malicious NewRole parameter. Because the parameter is inserted into an SQL command without proper integer validation, the attacker can inject arbitrary SQL statements. The resulting vulnerability is a classic SQL injection, identified as CWE‑89, that allows the authenticated user to read, modify, or delete data in the ChurchCRM database, potentially leading to data compromise and loss of integrity.

ChurchCRM, an open‑source church management solution, is affected in all releases prior to version 7.1.0. The issue resides in the Community Relationship Management (CRM) component, specifically src/MemberRoleChange.php. Administrators using older installations are at risk unless they upgrade to the patched 7.1.0 release.

The CVSS score of 8.8 reflects high severity, and the lack of an EPSS score means we cannot quantify likelihood from that metric. The vulnerability requires an authenticated session with ManageGroups privileges and knowledge of a valid group ID and person ID, which can be discovered via GroupView or PersonView interfaces. Because these prerequisites are readily available to a regular user who can navigate the system, the risk of exploitation is significant. The vulnerability was addressed in version 7.1.0, which deploys proper integer validation and eliminates the injection path.