A blind SQL injection is present in the /SettingsIndividual.php endpoint of ChurchCRM. Exploitation is achieved by injecting arbitrary SQL statements through the type array parameter via its index. Authenticated users who do not possess any special privileges can use this flaw to read sensitive data from the database or modify existing records, resulting in both confidentiality and integrity loss. The injection is blind, meaning it does not return data directly in the response, but still allows a determined attacker to extract information through other side‑channel techniques.

ChurchCRM (open‑source church management system) version 7.0.5 is affected. The vulnerability was discovered in the CRM application and has been addressed in version 7.1.0. Users running older releases are therefore at risk.

The CVSS score is 8.8, classifying the flaw as high severity. EPSS indicates a low probability of exploitation (less than 1 %). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Since the flaw requires authentication and does not grant any special privileges, the attacker must first obtain legitimate user credentials or compromise an existing account. Once authenticated, the user can target the vulnerable endpoint to conduct arbitrary SQL operations.