ChurchCRM vulnerabilities

In ChurchCRM prior to version 7.4.0, an authenticated administrator can achieve Remote Code Execution (RCE) on the server by installing a malicious plugin ZIP archive containing a PHP webshell. The application explicitly includes 'php' in its ALLOWED_EXTENSIONS list, while the dangerous extensions denylist fails to block standard .php files, allowing direct code execution via HTTP after extraction in the web root.

ChurchCRM is an open-source church management system. In versions 7.2.0 to 7.2.2, the fix for CVE-2026-4058 is incomplete, allowing for exploitation of this vulnerability.

ChurchCRM is an open-source church management system. In versions prior to 7.3.2, the fix for CVE-2026-39337 is incomplete, allowing for pre-authentication remote code execution via unsanitized DB_PASSWORD.

In ChurchCRM before 7.2.0, the /api/public/user/login endpoint validates only username and password, bypassing account lockout and two-factor authentication. An attacker with knowledge of a password can obtain API access even when the account is locked or 2FA is enabled.

ChurchCRM before version 6.5.3 contains a SQL injection vulnerability in the Event Attendee Editor. An authenticated user can execute arbitrary SQL commands, leading to complete database compromise, administrative credential theft, and potential system takeover. Attackers can extract sensitive member data, credentials, and financial information. Version 6.5.3 includes a patch.

ChurchCRM before version 6.5.3 may disclose database information in error messages, including host, IP, username, and password. Version 6.5.3 fixes the issue.

ChurchCRM before version 6.5.3 in the Database Restore functionality does not validate the content or file extension of uploaded files. An attacker can upload a web shell file and subsequently upload a .htaccess file to enable direct access. Once accessed, the web shell allows remote code execution (RCE) on the server. Version 6.5.3 fixes the issue.

ChurchCRM before version 5.21.0 contains a pre-authentication remote code execution vulnerability in the setup wizard. An unauthenticated attacker can inject arbitrary PHP code during the installation process, leading to complete server compromise. The issue arises from directly concatenating user input from the setup form into a PHP configuration template without validation.

ChurchCRM before version 7.4.0 has XSS vulnerabilities due to insufficient output encoding of user-controlled parameter names and values. An attacker can reflect malicious script into JavaScript or HTML contexts.

In ChurchCRM prior to version 7.4.0, an authorization flaw in family-scoped endpoints allowed low-privileged users to read and modify other families' records. An authenticated non-admin user with EditSelf access can supply another family's familyId and access records outside their own family scope. The backend trusts the attacker-controlled familyId and loads the corresponding family entity without verifying that the requested family belongs to the current user.

In ChurchCRM prior to version 7.4.0, a low-privileged user can bypass the /admin/export UI and exfiltrate the entire member directory. The POST /CSVCreateFile.php endpoint generates and streams a CSV containing the full Personally Identifiable Information (PII) of every Person/Family record in the database, without performing any feature-level or object-level authorization check beyond the coarse 'has any admin permission' gate inherited from the legacy page bootstrap. In other words, any single non-admin permission flag is enough to reach the CSV bulk-export endpoint, even though such users should not have data export rights. The export script is missing a dedicated isAdmin() (or a new bExportData) authorization check of its own. This issue has been fixed in version 7.4.0.

ChurchCRM is an open-source church management system. Prior to version 7.3.2, an attacker could exploit top-level GET navigation from an external page to FundRaiserDelete.php, PropertyTypeDelete.php, or NoteDelete.php, allowing a logged-in user with the relevant role to silently delete records.

ChurchCRM versions prior to 7.2.0 render stored usernames directly into an HTML input value attribute in UserEditor.php without htmlspecialchars(). An administrator can save a username containing HTML attribute-breaking characters and event handlers that execute in the browser of any administrator viewing that user's editor page, resulting in stored XSS. The issue is fixed in version 7.2.0.

In ChurchCRM versions prior to 7.2.0, the public API login endpoint (/api/public/user/login) returns distinguishable HTTP response codes based on whether a username exists: 404 for non-existent users and 401 for valid users with incorrect passwords. An unauthenticated attacker can exploit this difference to enumerate valid usernames, with no rate limiting or account lockout to impede the process.

ChurchCRM versions prior to 7.2.0 contain a stored XSS vulnerability in the Pledge Editor, which renders donation comment values directly into HTML input value attributes without escaping via htmlspecialchars(). An authenticated user with Finance permissions can inject HTML attribute-breaking characters and event handlers that are stored in the database and execute in the browser of any user opening the pledge record.

ChurchCRM before version 7.2.0 has an SQL injection vulnerability in FinancialService::getMemberByScanString() due to unsanitized $routeAndAccount concatenated into raw SQL. This issue has been fixed in version 7.2.0.

ChurchCRM before version 7.2.0 has an object-level authorization vulnerability in the GET /api/person/{personId} endpoint. Any authenticated user with only EditSelf privileges can enumerate and read other members' records, exposing sensitive PII including names, addresses, phone numbers, and email addresses.

ChurchCRM prior to 7.0.0 allowed creating links that, when an authenticated user clicked the 'Cancel' button, would redirect them to any URL chosen by an attacker. The issue affects all instances using the 'linkBack' parameter, with DonatedItemEditor.php given as an example. The vulnerability is fixed in 7.0.0.

ChurchCRM prior to 7.1.0 has an XSS vulnerability where attacker-supplied input via the EName and EDesc parameters in EditEventAttendees.php is rendered without proper output encoding, enabling arbitrary JavaScript execution in victims' browsers. This is fixed in 7.1.0.

ChurchCRM before version 7.1.0 has a reflected XSS vulnerability on the login page due to lack of sanitization of the username parameter from the URL. The parameter is directly displayed in the input field, allowing injection of malicious JavaScript that can steal sessions or replace the login form.

In ChurchCRM prior to version 7.1.0, a SQL injection vulnerability exists in the EditEventTypes.php file, accessible only to administrators. The EN_tyid POST parameter is not sanitized before being used in a SQL query, allowing an administrator to execute arbitrary SQL commands. This vulnerability is fixed in version 7.1.0.

SQL injection vulnerability in ChurchCRM before 7.1.0 in the searchwhat parameter via QueryView.php with QueryID=15. Authenticated users with proper permissions can inject SQL queries.

ChurchCRM prior to version 7.1.0 is vulnerable to time-based SQL Injection due to improper input validation. The endpoint Reports/ConfirmReportEmail.php?familyId= does not correctly sanitize user input, and the sanitized input is not used to create the SQL query. This vulnerability is fixed in version 7.1.0.

In ChurchCRM prior to 7.1.0, a Blind Reflected Cross-Site Scripting vulnerability exists in the search parameter accepted by the ChurchCRM dashboard. The application fails to sanitize or encode user-supplied input before rendering it in the browser's DOM; although an HTTP 500 error is ultimately returned, the browser's JavaScript engine parses and executes the injected <script> tags before the error response is returned.

In ChurchCRM before 7.1.0, a stored XSS issue affects Directory Reports form fields set from config, Person editor defaults rendered into address fields, and external self-registration form defaults. This is primarily an admin-to-admin stored XSS path abusing writable configuration fields.

ChurchCRM prior to 7.1.1 contains Stored XSS in group remove control and family editor state/country. This is primarily an admin-to-admin stored XSS path when writable entity fields are abused.

ChurchCRM is an open-source church management system. Prior to 6.5.3, it is possible to trigger server-side HTTP/HTTPS requests to arbitrary hosts (SSRF) by supplying a crafted URL in the Referer request header; the server then makes an outbound request to the attacker-controlled domain (confirmed via OAST); this is fixed in 6.5.3.

A privilege escalation vulnerability exists in ChurchCRM prior to version 6.5.3. An authenticated user with specific mid-level permissions ("Edit Records" and "Manage Properties and Classifications") can inject a persistent Cross-Site Scripting (XSS) payload into an administrator's profile, which executes when the administrator views their own profile page. The vulnerability combines an Insecure Direct Object Reference (IDOR) and a Broken Access Control flaw.

ChurchCRM is an open-source church management system. Prior to version 6.5.0, the application echoes back plaintext passwords submitted by users in subsequent HTTP responses. This information disclosure significantly increases the risk of credential compromise.

ChurchCRM is an open-source church management system. Prior to version 6.5.0, a SQL injection vulnerability exists in the `EventEditor.php` file. When creating a new event and selecting an event type, the `EN_tyid` POST parameter is not sanitized. This allows an authenticated user with event management permissions (`isAddEvent`) to execute arbitrary SQL queries. Version 6.5.0 fixes the issue.

In ChurchCRM 6.2.0 and earlier, there is a time-based blind SQL injection in the handling of the 1FieldSec parameter. Injecting SLEEP() causes deterministic server-side delays, proving the value is incorporated into a SQL query without proper parameterization. The issue allows data exfiltration and modification via blind techniques.

ChurchCRM up to 5.18.0 contains a path traversal vulnerability in src/ChurchCRM/Backup/RestoreJob.php within the Backup Restore Handler component. Manipulation of the restoreFile argument can lead to path traversal. The attack may be launched remotely, and the exploit has been publicly disclosed and may be utilized. The vendor was contacted but did not respond.

In ChurchCRM up to 5.18.0, the file setup/routes/setup.php allows manipulation of the DB_PASSWORD/ROOT_PATH/URL arguments leading to deserialization. The attack can be initiated remotely and its complexity is rated high. The exploit has been made public and the vendor did not respond.