Blind SQL Injection Vulnerability in ChurchCRM by ChurchCRM
CVE-2023-29842

8.8HIGH

Key Information:

Vendor

Churchcrm

Status
Churchcrm
Vendor
CVE Published:
4 May 2023

What is CVE-2023-29842?

ChurchCRM version 4.5.4 has a vulnerability in the /EditEventTypes.php endpoint, allowing for a Blind SQL Injection through the EN_tyid POST parameter. An attacker can exploit this vulnerability to execute arbitrary SQL commands on the database, potentially leading to unauthorized access to sensitive information. Mitigation measures should be taken promptly to protect affected installations.

References

https://github.com/ChurchCRM/CRM
https://github.com/arvandy/CVE/blob/main/CVE-2023-29842/C...
https://github.com/arvandy/CVE/blob/main/CVE-2023-29842/C...

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.