Lucene search
China National Vulnerability DatabaseCNVD-2023-64491HistoryAug 12, 2023 - 12:00 a.m.
ChurchCRM friendmonths parameter SQL Injection Vulnerability
2023-08-1200:00:00
China National Vulnerability Database
www.cnvd.org.cn
4
churchcrm
sql injection
friendmonths parameter
queryview.php
database theft
0.001 Low
EPSS
Percentile
25.0%
ChurchCRM is an open source CRM system for churches. ChurchCRM version v5.0.0 suffers from a SQL injection vulnerability that stems from a lack of validation of externally entered SQL statements in the friendmonths parameter in QueryView.php. An attacker can exploit this vulnerability to execute illegal SQL commands to steal sensitive database data.
| CPE | Name | Operator | Version |
|---|---|---|---|
| churchcrm churchcrm v | eq | 5.0.0 |
Related
cvelist
cvelist
CVE-2023-38762
2023-08-08 00:00:00
cve
cve
CVE-2023-38762
2023-08-08 16:15:12
nvd
nvd
CVE-2023-38762
2023-08-08 16:15:12
osv
osv
CVE-2023-38762
2023-08-08 16:15:12
prion
prion
Sql injection
2023-08-08 16:15:00