This vulnerability allows authenticated users with Manage Properties permission to execute arbitrary SQL commands by injecting payloads into the Name and Description fields of PropertyTypeEditor.php. Because the input is sanitized only with strip_tags() before direct concatenation into queries, SQL injection occurs. Attackers can exfiltrate sensitive data, modify records, or delete data. The injected data can persist in the database and appear on multiple pages without output encoding, enabling cross‑page data exposure.

ChurchCRM, version prior to 7.1.0. The affected product is the ChurchCRM CRM component as listed by the CNA. The fix was introduced in version 7.1.0.

The CVSS base score of 8.8 indicates high severity. EPSS data is unavailable and the vulnerability is not listed in the CISA KEV catalog. Authentication and Manage Properties permission are required, implying the threat vector is local/internal to an authenticated user. No public exploit is documented, but the high severity, persistence of injected data, and potential for data exfiltration and modification make the risk significant for organizations running vulnerable versions.