CVE-2025-1134
Published: 19 February 2025
Summary
CVE-2025-1134 is a critical-severity SQL Injection (CWE-89) vulnerability in Churchcrm Churchcrm. Its CVSS base score is 9.3 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Databases (T1213.006); ranked at the 35.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-1134 is a boolean-based and time-based blind SQL injection vulnerability (CWE-89) in ChurchCRM versions 5.13.0 and prior. The flaw exists in the DonatedItemEditor functionality, where the CurrentFundraiser parameter is directly concatenated into an SQL query without sufficient sanitization. This allows attackers to execute arbitrary SQL queries, with a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
The vulnerability requires administrator privileges for exploitation. An attacker with admin access can leverage the issue over the network with low attack complexity and no user interaction, manipulating database queries to achieve high impacts on confidentiality, integrity, and availability, such as data exfiltration, modification, or deletion.
Mitigation details are available in the GitHub issue at https://github.com/ChurchCRM/CRM/issues/7253.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-4717
Vulnerability details
A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to execute arbitrary SQL queries by exploiting a boolean-based and time-based blind SQL Injection vulnerability in the DonatedItemEditor functionality. The CurrentFundraiser parameter is directly concatenated into an SQL…
more
query without sufficient sanitization, allowing an attacker to manipulate database queries and execute arbitrary commands, potentially leading to data exfiltration, modification, or deletion. Please note that this vulnerability requires Administrator privileges.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The blind SQL injection vulnerability enables arbitrary SQL query execution on the database, facilitating data collection from databases (T1213.006), manipulation of stored data (T1565.001), and data destruction via deletion (T1485).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 directly prevents SQL injection by requiring validation and sanitization of inputs like the CurrentFundraiser parameter before concatenation into SQL queries.
SI-2 mandates timely remediation of flaws such as this SQL injection vulnerability through patching, as referenced in the ChurchCRM GitHub mitigation.
RA-5 requires vulnerability scanning that would identify the blind SQL injection in DonatedItemEditor functionality for subsequent remediation.