CVE-2025-1135
Published: 19 February 2025
Summary
CVE-2025-1135 is a critical-severity SQL Injection (CWE-89) vulnerability in Churchcrm Churchcrm. Its CVSS base score is 9.3 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 28.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-1135 is a boolean-based and time-based blind SQL injection vulnerability affecting ChurchCRM versions 5.13.0 and prior. The flaw resides in the BatchWinnerEntry functionality, where the CurrentFundraiser parameter is directly concatenated into an SQL query without sufficient sanitization. This allows attackers to manipulate database queries and execute arbitrary SQL commands. The vulnerability is classified under CWE-89 with a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
Exploitation requires administrator privileges, enabling a high-privilege network attacker with low complexity to achieve high impacts on confidentiality, integrity, and availability. A successful attack can result in arbitrary SQL query execution, potentially leading to complete data exfiltration, modification, or deletion from the database.
The vulnerability is documented in ChurchCRM's GitHub repository at https://github.com/ChurchCRM/CRM/issues/7254.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-4709
Vulnerability details
A vulnerability exists in ChurchCRM 5.13.0. and prior that allows an attacker to execute arbitrary SQL queries by exploiting a boolean-based and time-based blind SQL Injection vulnerability in the BatchWinnerEntry functionality. The CurrentFundraiser parameter is directly concatenated into an SQL…
more
query without sufficient sanitization, allowing an attacker to manipulate database queries and execute arbitrary commands, potentially leading to data exfiltration, modification, or deletion. Please note the vulnerability requires Administrator privileges.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection vulnerability in web application enables exploitation of public-facing app (T1190), database data collection (T1213.006), stored data manipulation (T1565.001), and data destruction via arbitrary SQL queries (T1485).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the SQL injection vulnerability by requiring validation and sanitization of the unsanitized CurrentFundraiser parameter before concatenation into SQL queries.
Ensures timely identification, reporting, and patching of the specific SQL injection flaw in ChurchCRM's BatchWinnerEntry functionality.
Reduces the attack surface by enforcing least privilege, limiting the number of administrator accounts that could exploit the privilege-required vulnerability.