A blind SQL injection flaw exists in the PropertyAssign.php endpoint of ChurchCRM, allowing certain authenticated users to inject arbitrary SQL through the Value parameter. The vulnerability can be used to read sensitive data or modify the database, potentially leaking confidential church records or altering membership information. It is a classic input validation weakness listed as CWE‑89, which can lead to significant confidentiality and integrity violations.

ChurchCRM version 7.0.x and earlier are affected. The vulnerability is present in the ChurchCRM open‑source church management system before the 7.1.0 release. Only users with the Manage Groups & Roles role and the permission to edit records can exploit the flaw.

The CVSS v3 score of 8.8 indicates high severity. The EPSS score is below 1%, suggesting that current exploitation attempts are rare, and the vulnerability is not in CISA’s KEV catalog. The likely attack path requires an authenticated session with the appropriate role; an attacker must first log in to the web interface and then send a crafted request to PropertyAssign.php. With this access, the SQL injection can be leveraged to read or alter database contents.