A vulnerable parameter named EN_tyid in ChurchCRM’s EditEventTypes.php is concatenated into a SQL query without validation, enabling a classic SQL Injection flaw classified as CWE-89. An administrator can inject malicious SQL and gain unrestricted read, write, or delete access to the underlying database, potentially exposing sensitive church member data or corrupting records.

All installations of ChurchCRM before version 7.1.0 are affected, but the flaw can only be exploited through the administrative event type editing interface, meaning only users with administrator privileges on the system can trigger the injection.

The vulnerability carries a CVSS score of 7.2, indicating high severity, while the EPSS score of less than 1% suggests limited current exploitation attempts and it is not listed in the CISA KEV catalog. Based on the description, the attack vector is local within an authenticated administrative session; the attacker must possess administrator rights to supply the unsanitized parameter, but once achieved, the impact is comprehensive database compromise.