The vulnerability arises from EcclesiaCRM’s ValidateInput() function, where a default case in the query view passes user‑supplied POST parameters directly into SQL statements via a string replacement without any sanitization. This oversight allows an attacker to inject arbitrary SQL code when submitting query parameters that are not subject to standard validation, potentially enabling modification, deletion, or exposure of sensitive church data. The weakness is a classic SQL injection flaw identified as CWE‑89.

The issue affects EcclesiaCRM version 8.0.0 and all earlier releases by the vendor phili67. The vulnerability exists in the ValidateInput() function that is invoked during query view processing and can be triggered by any POST request to the application’s query endpoint. Users running these affected versions without applying the missing fix are at risk.

With a CVSS score of 8.7, the flaw represents a high‑severity condition. No EPSS score is available, and the vulnerability is not yet listed in CISA’s KEV catalog, suggesting limited evidence of active exploitation at this time. The attacker would need to craft a malicious POST request targeting the query view, but the lack of input validation enables direct exploitation without additional privileges, making this a relatively straightforward remote attack vector.