CVE-2026-39319
Published: 07 April 2026
Summary
CVE-2026-39319 is a high-severity SQL Injection (CWE-89) vulnerability in Churchcrm Churchcrm. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 11.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents the second-order SQL injection by requiring validation and sanitization of the iCurrentFundraiser session parameter before database use.
Ensures timely patching of ChurchCRM to version 7.1.0 or later, remediating the specific SQL injection flaw in FundRaiserEditor.php.
Vulnerability scanning identifies SQL injection flaws like this one in the FundRaiserEditor.php endpoint for subsequent remediation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in web app endpoint directly enables exploitation of public-facing application (T1190) for database data collection (T1213.006) and stored data manipulation (T1565.001).
NVD Description
ChurchCRM is an open-source church management system. Prior to 7.1.0, a second order SQL injection vulnerability was found in the endpoint /FundRaiserEditor.php in ChurchCRM. A user has to be authenticated but doesn't need any privileges. These users can inject arbitrary…
more
SQL statements through the iCurrentFundraiser PHP session parameter and thus extract and modify information from the database. This vulnerability is fixed in 7.1.0.
Deeper analysisAI
CVE-2026-39319 is a second-order SQL injection vulnerability (CWE-89) in ChurchCRM, an open-source church management system. The flaw affects versions prior to 7.1.0 and is located in the /FundRaiserEditor.php endpoint, where the iCurrentFundraiser PHP session parameter fails to properly sanitize input, allowing injection of arbitrary SQL statements.
Any authenticated user, without requiring elevated privileges, can exploit this vulnerability over the network with low complexity and no user interaction. Exploitation enables attackers to extract sensitive data from the database and modify information, resulting in high impacts to confidentiality, integrity, and availability, as reflected in the CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
ChurchCRM has fixed this vulnerability in version 7.1.0. Additional details on the patch and mitigation recommendations are available in the GitHub security advisory at https://github.com/ChurchCRM/CRM/security/advisories/GHSA-vg4m-hc29-jgqj.
Details
- CWE(s)