Cyber Posture

CVE-2025-1134

HighPublic PoC

Published: 19 February 2025

Published
19 February 2025
Modified
25 February 2025
KEV Added
Patch
CVSS Score 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0015 35.5th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-1134 is a high-severity SQL Injection (CWE-89) vulnerability in Churchcrm Churchcrm. Its CVSS base score is 7.2 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Databases (T1213.006); ranked at the 35.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Databases (T1213.006) and 2 other techniques. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

SI-10 directly prevents SQL injection by requiring validation and sanitization of inputs like the CurrentFundraiser parameter before concatenation into SQL queries.

preventrecover

SI-2 mandates timely remediation of flaws such as this SQL injection vulnerability through patching, as referenced in the ChurchCRM GitHub mitigation.

detect

RA-5 requires vulnerability scanning that would identify the blind SQL injection in DonatedItemEditor functionality for subsequent remediation.

MITRE ATT&CK Enterprise TechniquesAI

T1213.006 Databases Collection
Adversaries may leverage databases to mine valuable information.
T1565.001 Stored Data Manipulation Impact
Adversaries may insert, delete, or manipulate data at rest in order to influence external outcomes or hide activity, thus threatening the integrity of the data.
T1485 Data Destruction Impact
Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources.
Why these techniques?

The blind SQL injection vulnerability enables arbitrary SQL query execution on the database, facilitating data collection from databases (T1213.006), manipulation of stored data (T1565.001), and data destruction via deletion (T1485).

NVD Description

A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to execute arbitrary SQL queries by exploiting a boolean-based and time-based blind SQL Injection vulnerability in the DonatedItemEditor functionality. The CurrentFundraiser parameter is directly concatenated into an SQL…

more

query without sufficient sanitization, allowing an attacker to manipulate database queries and execute arbitrary commands, potentially leading to data exfiltration, modification, or deletion. Please note that this vulnerability requires Administrator privileges.

Deeper analysisAI

CVE-2025-1134 is a boolean-based and time-based blind SQL injection vulnerability (CWE-89) in ChurchCRM versions 5.13.0 and prior. The flaw exists in the DonatedItemEditor functionality, where the CurrentFundraiser parameter is directly concatenated into an SQL query without sufficient sanitization. This allows attackers to execute arbitrary SQL queries, with a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

The vulnerability requires administrator privileges for exploitation. An attacker with admin access can leverage the issue over the network with low attack complexity and no user interaction, manipulating database queries to achieve high impacts on confidentiality, integrity, and availability, such as data exfiltration, modification, or deletion.

Mitigation details are available in the GitHub issue at https://github.com/ChurchCRM/CRM/issues/7253.

Details

CWE(s)

Affected Products

churchcrm
churchcrm
≤ 5.13.0

CVEs Like This One

CVE-2025-1133Same product: Churchcrm Churchcrm
CVE-2026-39329Same product: Churchcrm Churchcrm
CVE-2025-1135Same product: Churchcrm Churchcrm
CVE-2026-39343Same product: Churchcrm Churchcrm
CVE-2025-1023Same product: Churchcrm Churchcrm
CVE-2026-24854Same product: Churchcrm Churchcrm
CVE-2026-39340Same product: Churchcrm Churchcrm
CVE-2026-39319Same product: Churchcrm Churchcrm
CVE-2026-39342Same product: Churchcrm Churchcrm
CVE-2025-1132Same product: Churchcrm Churchcrm

References