CVE-2024-25897
Published: 21 February 2024
Summary
CVE-2024-25897 is a critical-severity SQL Injection (CWE-89) vulnerability in Churchcrm Churchcrm. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 6.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
ChurchCRM version 5.5.0 contains a blind time-based SQL injection vulnerability in FRCatalog.php that is triggered through the CurrentFundraiser GET parameter. The flaw is tracked as CWE-89 and carries a CVSS 3.1 score of 9.8, reflecting network-accessible attack complexity that requires no authentication or user interaction.
An unauthenticated remote attacker can supply crafted input to the affected parameter and leverage the time-based blind SQL injection to extract, modify, or delete arbitrary database contents, resulting in complete loss of confidentiality, integrity, and availability of the ChurchCRM instance.
Public references consist of GitHub issue reports that document the flaw but provide no explicit patch or mitigation guidance in the available records. The associated EPSS score has remained flat at 0.1232 with no material upward trajectory observed after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-23199
Vulnerability details
ChurchCRM 5.5.0 FRCatalog.php is vulnerable to Blind SQL Injection (Time-based) via the CurrentFundraiser GET parameter.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.