ChurchCRM, an open‑source church management system, contains a flaw in QueryView.php that allows an authenticated user to inject SQL through the searchwhat parameter when using QueryID=15. An attacker who can access Data/Reports > Query Menu and the Advanced Search query can manipulate statements, which may expose sensitive data, alter or delete database records, or otherwise compromise the integrity of the system. The weakness is a classic SQL Injection (CWE‑89).

The vulnerability affects all ChurchCRM deployments prior to version 7.1.0. Users who have legitimate access to the relevant reports and advanced search functionality are at risk, regardless of the total user base. There is no narrower version scope reported.

The CVSS score of 9.4 indicates a critical impact, yet the EPSS score of less than 1% suggests that exploitation is currently unlikely in the wild. The flaw is not listed in the CISA Known Exploited Vulnerabilities catalog, further indicating that public exploitation has not been observed. Attack requires authentication and specific report permissions, so a successful exploit would be limited to users with those privileges. Nonetheless, the potential for confidential data exposure or database tampering warrants immediate action.