Blind SQL injection in the SettingsUser.php endpoint of ChurchCRM allows an authenticated administrator to inject arbitrary SQL statements. The vulnerability exposes the ability to read sensitive data and alter database contents, effectively compromising confidentiality, integrity, and potentially availability of church records. It is classified as a classic SQL injection (CWE-89).

The affected product is ChurchCRM, an open-source church management system. All released versions prior to 7.1.0, including the 7.0.5 build, are vulnerable. Administrators with valid credentials can exploit the flaw.

The CVSS score of 7.2 denotes a high severity, while the EPSS score of less than 1 % indicates a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated administrator account and is achieved through the index parameter in a blind manner, meaning the attacker receives limited feedback but can still extract and modify data over time.