SQL Injection Vulnerability in EcclesiaCRM Church Management Software
CVE-2026-44418

8.7HIGH

Key Information:

Vendor

Phili67

Status
Ecclesiacrm
Vendor
CVE Published:
13 May 2026

What is CVE-2026-44418?

EcclesiaCRM, a software designed for church management, is vulnerable to SQL injection in versions 8.0.0 and earlier. This vulnerability arises from the ValidateInput() function's default case, which improperly handles user-supplied POST parameters, leading to potential unauthorized access to the database. The misuse of str_replace without proper sanitization allows attackers to inject malicious SQL code. This issue highlights the necessity of implementing thorough input validation practices to safeguard against SQL injection attacks. The vulnerability is a result of an incomplete fix for a previously reported issue, emphasizing the importance of ongoing security assessments.

Affected Version(s)

ecclesiacrm <= 8.0.0

References

https://github.com/phili67/ecclesiacrm/security/advisorie...
x_refsource_CONFIRM
https://github.com/phili67/ecclesiacrm/commit/f743b97f89d...
x_refsource_MISC

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.