A time‑based blind SQL injection exists in PropertyTypeEditor.php that concatenates user‑supplied Name and Description values directly into INSERT and UPDATE queries. The flaw arose after replacing legacyFilterInput() with sanitizeText(), which removes only HTML but fails to escape SQL. An authenticated user with the MenuOptions role – a non‑admin staff permission – can exploit the flaw to retrieve arbitrary database contents, including all user password hashes.

ChurchCRM systems running any version prior to 7.1.0 are vulnerable. The issue is limited to the administration interface for managing property type categories (People → Person Properties / Family Properties).

The vulnerability receives a CVSS base score of 8.1, indicating a high severity. Its EPSS score is below 1 %, suggesting a low likelihood of public exploitation, and it is not listed in CISA’s KEV catalog. Nevertheless, an attacker must be authenticated and hold the MenuOptions permission, but this role is commonly granted to non‑admin staff, making the attack path feasible within many organizations.