ChurchCRM - CraftedSignal Threat Feed

ChurchCRM SQL Injection Vulnerability in PropertyTypeEditor.php

hello@craftedsignal.io — Mon, 29 Jan 2024 12:00:00 +0000

ChurchCRM, an open-source church management system, is vulnerable to SQL injection in versions prior to 7.1.0. The vulnerability, identified as CVE-2026-39323, resides in the PropertyTypeEditor.php component. The root cause is the insufficient sanitization of the Name and Description POST parameters. These parameters are only processed with strip_tags() before being directly concatenated into SQL queries. An authenticated user with "Manage Properties" permission can exploit this by injecting malicious SQL code through these parameters. Successful exploitation allows the attacker to execute arbitrary SQL commands, giving them the ability to exfiltrate sensitive data, modify existing records, or delete critical information from the database. The injected data persists in the database and is reflected across multiple application pages without proper output encoding, amplifying the impact. Users of ChurchCRM are advised to upgrade to version 7.1.0 or later to remediate this vulnerability.

Attack Chain

An attacker authenticates to the ChurchCRM application with an account that has the "Manage Properties" permission.
The attacker crafts a malicious HTTP POST request targeting PropertyTypeEditor.php.
The POST request includes SQL injection payloads within the Name and/or Description parameters.
The PropertyTypeEditor.php script receives the POST request and applies strip_tags() to the Name and Description parameters.
The sanitized, but still vulnerable, Name and Description parameters are concatenated directly into an SQL query without proper escaping or parameterization.
The malicious SQL query is executed against the ChurchCRM database.
The attacker gains the ability to manipulate database records, potentially exfiltrating sensitive data like user credentials, financial records, or personal information.
The injected data persists in the database and gets reflected in other application pages, further compromising the application's integrity.

Impact

Successful exploitation of this SQL injection vulnerability (CVE-2026-39323) in ChurchCRM can lead to severe consequences. An attacker can gain unauthorized access to sensitive data, including member information, financial records, and user credentials. The attacker could modify or delete critical data, disrupting church operations and potentially leading to financial losses. The number of organizations potentially affected is significant, as ChurchCRM is a widely used open-source solution for church management. The injected data will persist in the database and is reflected across multiple application pages without output encoding.

Recommendation

Upgrade ChurchCRM to version 7.1.0 or later to patch the SQL injection vulnerability (CVE-2026-39323).
Implement input validation and parameterized queries to prevent SQL injection attacks in PropertyTypeEditor.php and other database interaction points within ChurchCRM.
Deploy the Sigma rule to detect potential exploitation attempts targeting PropertyTypeEditor.php.
Review web server access logs for suspicious POST requests to PropertyTypeEditor.php (webserver log source).

ChurchCRM Remote Code Execution via Backup Restore Vulnerability (CVE-2026-40484)

hello@craftedsignal.io — Tue, 09 Jan 2024 12:00:00 +0000

ChurchCRM, an open-source church management system, is susceptible to remote code execution (RCE) in versions prior to 7.2.0. This vulnerability stems from the insecure handling of database backup restoration. Specifically, the recursiveCopyDirectory() function fails to adequately filter file extensions when extracting uploaded archive contents from the Images/ directory, copying files into the web-accessible document root. An authenticated administrator can exploit this by uploading a malicious backup archive containing a PHP webshell. Due to the lack of file extension filtering, this webshell is written to a publicly accessible path, enabling attackers to execute arbitrary code on the server as the web server user via HTTP requests. The absence of CSRF token validation on the restore endpoint further exacerbates the issue, enabling cross-site request forgery (CSRF) attacks against authenticated administrators. This vulnerability is identified as CVE-2026-40484.

Attack Chain

Attacker gains valid administrator credentials to the ChurchCRM application.
Attacker crafts a malicious backup archive containing a PHP webshell file (e.g., shell.php) within an Images/ directory structure.
The attacker uploads the crafted backup archive through the ChurchCRM administrative interface using the database backup restore functionality.
The application's recursiveCopyDirectory() function extracts the archive contents without proper file extension filtering.
The PHP webshell file (e.g., shell.php) is copied from the Images/ directory within the archive to a publicly accessible directory in the web server's document root.
The attacker leverages the lack of CSRF protection in the restore endpoint, possibly by tricking an administrator into triggering the restore via a malicious link or website.
The attacker sends an HTTP request to the uploaded PHP webshell (e.g., http://churchcrm.example.com/Images/shell.php?cmd=whoami) to execute arbitrary code on the server.
The web server executes the PHP code, granting the attacker remote code execution capabilities as the web server user.

Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code on the ChurchCRM server with the privileges of the web server user. This could lead to complete compromise of the server, data exfiltration (including sensitive church member data), defacement of the website, or further lateral movement within the network. Given the sensitive nature of data typically stored in church management systems, the impact can be severe.

Recommendation

Upgrade ChurchCRM to version 7.2.0 or later to patch CVE-2026-40484 immediately.
Implement a web application firewall (WAF) rule to detect and block requests to potentially malicious PHP files uploaded to the Images/ directory, specifically targeting HTTP requests with suspicious parameters like cmd=.
Deploy the Sigma rule detecting suspicious PHP file creation in web directories to identify potential webshell uploads.
Enable logging for web server access and error logs and monitor for unusual activity, especially related to the Images/ directory.

ChurchCRM < 7.2.0 Family Record Deletion CSRF Vulnerability

hello@craftedsignal.io — Tue, 09 Jan 2024 10:00:00 +0000

ChurchCRM, an open-source church management system, is susceptible to a critical Cross-Site Request Forgery (CSRF) vulnerability in versions prior to 7.2.0. Specifically, the family record deletion endpoint (SelectDelete.php) lacks CSRF token validation. This allows an attacker to craft a malicious web page that, when visited by an authenticated ChurchCRM administrator, will silently trigger the deletion of family records. The scope of this vulnerability extends to all associated data, including notes, pledges, persons, and property information. Successful exploitation results in irreversible data loss without user confirmation. Users are advised to upgrade to version 7.2.0 or later to mitigate this risk.

Attack Chain

Attacker identifies a vulnerable ChurchCRM instance running a version prior to 7.2.0.
Attacker crafts a malicious HTML page containing an or tag that makes a GET request to SelectDelete.php with the ID of the target family record. The URL looks like: https://example.com/ChurchCRM/FamilyView.php?FamilyID=123&Action=Delete.
Attacker social engineers an authenticated ChurchCRM administrator into visiting the malicious HTML page (e.g., via phishing or embedding the page on a compromised website).
The administrator's browser automatically sends the GET request to SelectDelete.php along with the administrator's valid session cookies.
The ChurchCRM server, lacking CSRF protection, processes the request and deletes the specified family record and all associated data.
The targeted family record, along with associated notes, pledges, persons, and property data, is permanently and irreversibly deleted from the ChurchCRM database.
The attacker achieves the objective of data deletion and potential disruption of church management operations.

Impact

A successful CSRF attack against ChurchCRM can result in the permanent and irreversible deletion of sensitive family records and associated data, potentially affecting hundreds or thousands of individuals depending on the size of the church and its record-keeping practices. This data loss can disrupt church operations, damage relationships with members, and lead to legal or regulatory compliance issues depending on the nature of the stored data. The lack of user interaction required for this exploit makes it particularly dangerous as administrators may be unaware that data is being deleted.

Recommendation

Upgrade ChurchCRM to version 7.2.0 or later to patch the CSRF vulnerability in SelectDelete.php (see Overview).
Deploy the provided Sigma rule to detect suspicious requests to SelectDelete.php (see Rules).
Implement web application firewall (WAF) rules to block requests to SelectDelete.php that lack a valid CSRF token, if possible.
Educate ChurchCRM administrators about the risks of CSRF attacks and the importance of avoiding suspicious links or websites.