ChurchCRM, an open‑source church management system, contains an SQL injection flaw in the GroupPropsFormRowOps.php, PersonCustomFieldsRowOps.php, and FamilyCustomFieldsRowOps.php endpoints. Attackers authenticated as users with ManageGroups privileges (or administrative users for the other two endpoints) can supply malicious content in the Field parameter, which is interpolated directly into SQL statements. This enables the attacker to insert, update, or delete rows in arbitrary database tables, compromising the integrity and confidentiality of church data and potentially giving the attacker a foothold for further exploitation.

All ChurchCRM installations running any version prior to 7.1.0 are affected. The vulnerability applies to the server‑side script that handles group, person custom field, and family custom field operations.

The CVSS score of 8.8 classifies this vulnerability as high severity. EPSS indicates a very low probability of exploitation, and it is not currently listed in CISA’s KEV catalog. Exploitation requires authentication and sufficient privileges, meaning the attacker must first obtain valid credentials or elevate privileges. Nevertheless, once authenticated, the attack path is straightforward: a crafted request to the vulnerable endpoint with a malicious Field value will execute arbitrary SQL.