A vulnerable array key in ChurchCRM's SettingsIndividual.php allows an attacker who has authenticated to inject arbitrary SQL. The unsanitized POST parameter is directly incorporated into SQL queries, enabling extraction of sensitive database contents. The flaw is rated CVSS 8.8, indicating high risk to confidentiality and integrity.

All installations of ChurchCRM older than version 7.1.0 are affected. The issue exists in the SettingsIndividual.php module within the ChurchCRM:CRM product. Administrators using version 7.0.x or earlier must be aware that users with valid credentials can leverage the flaw to pull confidential data from the database.

Because authentication is required, attackers need either compromised credentials or privileged user accounts. The high CVSS score signals a serious threat, but the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation yet. Nevertheless, the attack path is straightforward once access is obtained, making rapid patching a priority.