SQL Injection Vulnerability in ChurchCRM Management System
CVE-2025-68400

9.3CRITICAL

Key Information:

Vendor

Churchcrm

Status
Crm
Vendor
CVE Published:
17 December 2025

What is CVE-2025-68400?

A SQL Injection vulnerability has been identified in the legacy endpoint /Reports/ConfirmReportEmail.php of ChurchCRM, an open-source church management system. This vulnerability exists in versions prior to 6.5.3. Despite the related feature being removed from the user interface, the underlying file remains accessible directly via URL, allowing exploitation of SQL injection through the familyId parameter by any authenticated user, even those without assigned permissions. The issue has been patched in version 6.5.3.

Affected Version(s)

CRM < 6.5.3

References

https://github.com/ChurchCRM/CRM/security/advisories/GHSA...
x_refsource_CONFIRM

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-68400 : SQL Injection Vulnerability in ChurchCRM Management System