by Kastro
Paper/Archive/CVE-2024-53438

CVE-2024-53438

churchcrm churchcrm — EventAttendance.php in ChurchCRM 5.7.0 is vulnerable to SQL injection.

EPSS 0.5%public exploitCVSS 9.8
critical.is priorityof 100
49
CVSS 9.8 (ADP, NVD agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 45.8.458 × 209.2Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

EventAttendance.php in ChurchCRM 5.7.0 is vulnerable to SQL injection. An attacker can exploit this vulnerability by manipulating the 'Event' parameter, which is directly interpolated into the SQL query without proper sanitization or validation, allowing attackers to execute arbitrary SQL commands.

Affected

ProductAffectedFixed inSource
n/an/a–CNA
churchcrm5.7.0–CISA-ADP

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refgithub.com/ChurchCRM/CRM/issues/6988refgithub.com/advisories/GHSA-gr5x-8j97-qq23