The issue is a second‑order SQL injection located in the /FundRaiserEditor.php page of ChurchCRM versions older than 7.1.0. An authenticated user can supply a specially crafted value for the iCurrentFundraiser session variable, which is later concatenated into an SQL statement without proper sanitisation. This permits execution of arbitrary SQL commands, allowing the attacker to read sensitive database contents or modify records, potentially exposing membership and financial data.

All installations of ChurchCRM running a release before 7.1.0 are vulnerable, regardless of customisations, as the flaw resides in the core source code. The vulnerability is triggered by any authenticated user, even those with minimal privileges, because authentication alone is sufficient to reach the endpoint and manipulate the session variable.

The flaw carries a CVSS base score of 8.8, indicating high severity, while its EPSS score is below 1 %, suggesting that widespread exploitation is presently unlikely. The vulnerability is not listed in the CISA KEV catalog. An attacker would need an existing session cookie or valid credentials; once in, they can extract or alter data, undermining confidentiality, integrity, and potentially the availability of the system.