ChurchCRM contains a SQL injection vulnerability in the /MemberRoleChange.php endpoint that allows authenticated users with the Manage Groups & Roles role to inject arbitrary SQL statements through the NewRole parameter. This weakness, classified as CWE-89, enables attackers to read or modify database contents, potentially compromising confidentiality, integrity, and availability of church records. The vulnerability exists in versions prior to 7.1.0, specifically 7.0.5, and any earlier releases.

Affected systems include the ChurchCRM open‑source management platform, specifically the CRM product. Vulnerable releases are any versions older than 7.1.0, with 7.0.5 stated as a known affected version. Administrators should verify which version their installation is running and update accordingly.

With a CVSS score of 8.8 the vulnerability is considered high severity, but the EPSS score of less than 1% indicates a low expected exploitation probability in the wild. The vulnerability is not listed in CISA’s KEV catalog, suggesting no known active exploits. Exploitation requires a valid user account with the Manage Groups & Roles permission and involves sending a crafted request containing malicious SQL via the NewRole field to the MemberRoleChange.php endpoint.