CVE-2026-39329
Published: 07 April 2026
Summary
CVE-2026-39329 is a high-severity SQL Injection (CWE-89) vulnerability in Churchcrm Churchcrm. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 11.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents SQL injection by requiring validation and sanitization of unescaped user inputs like newEvtTypeCntLst before database query interpolation.
Mandates timely identification, reporting, and correction of the specific SQL injection flaw fixed in ChurchCRM version 7.1.0.
Limits exploitation impact by enforcing least privilege, reducing the number of authenticated users with AddEvent permissions.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in web app component allows network exploitation of public-facing application (T1190) for arbitrary DB queries, directly enabling data collection from databases (T1213.006), stored data manipulation (T1565.001), and data destruction via deletion (T1485).
NVD Description
ChurchCRM is an open-source church management system. Prior to 7.1.0, an SQL injection vulnerability was identified in /EventNames.php in ChurchCRM. Authenticated users with AddEvent privileges can inject SQL via the newEvtTypeCntLst parameter during event type creation. The vulnerable flow reaches…
more
an ON DUPLICATE KEY UPDATE clause where unescaped user input is interpolated directly. This vulnerability is fixed in 7.1.0.
Deeper analysisAI
CVE-2026-39329 is an SQL injection vulnerability (CWE-89) affecting ChurchCRM, an open-source church management system, in versions prior to 7.1.0. The issue resides in the /EventNames.php component, where authenticated users with AddEvent privileges can inject malicious SQL payloads via the newEvtTypeCntLst parameter during event type creation. The vulnerable code path interpolates unescaped user input directly into an ON DUPLICATE KEY UPDATE clause, enabling arbitrary SQL execution.
Attackers require low-privileged network access as authenticated users with AddEvent permissions, with low attack complexity and no user interaction needed. Successful exploitation grants high-impact confidentiality, integrity, and availability effects (CVSS 8.8: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), potentially allowing database read, modification, or deletion operations depending on the backend database and user privileges.
The vulnerability is addressed in ChurchCRM version 7.1.0. For mitigation details, refer to the GitHub security advisory at https://github.com/ChurchCRM/CRM/security/advisories/GHSA-ggfm-5q4w-p93g.
Details
- CWE(s)