ChurchCRM contains an unescaped input called newEvtTypeCntLst in EventNames.php that is concatenated directly into an ON DUPLICATE KEY UPDATE clause. When exploited, the query can be manipulated to read from or alter database tables. The vulnerability is blind, so attackers do not receive direct error messages, but they can infer results through timing or effects on data.

The flaw exists in ChurchCRM versions before 7.1.0. Any installation of the ChurchCRM open‑source management system using these versions is affected. The issue is tied to the EventNames.php component and touches database operations performed during event type creation by users who hold AddEvent privileges.

The CVSS score of 8.8 indicates high severity. The EPSS score of less than 1% suggests the likelihood of exploitation is currently low, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires a valid authenticated account with AddEvent permissions, so the attack vector is authenticated. Once accessed, an attacker can execute arbitrary SQL commands against the application’s database, potentially compromising confidentiality and integrity of church data.