The vulnerability exists in the /api/families/byCheckNumber/{scanString} endpoint of ChurchCRM, where user‑supplied input is concatenated into a raw SQL query without proper sanitization. This allows an authenticated attacker to manipulate the SQL statement, potentially extracting, modifying, or deleting data from the database. The flaw is a classic SQL injection (CWE‑89) that compromises confidentiality, integrity, and availability of financial records.

ChurchCRM (CRM) versions prior to 7.2.0 are affected. The issue was identified in the FinancialService::getMemberByScanString() method and is fixed in release 7.2.0.

The CVSS score of 7.1 indicates a high severity for authenticated users. Since no EPSS data is available and the vulnerability is not listed in the CISA KEV catalog, the likelihood of immediate exploitation appears moderate, though the authenticated nature of the endpoint means any user with access can potentially leverage the flaw. Ingress would involve interacting with the vulnerable API endpoint after authentication, making mitigation a priority.