Lucene search

GoogleOSV:CVE-2023-24685

HistoryFeb 09, 2023 - 10:15 p.m.

CVE-2023-24685

2023-02-0922:15:11

Google

osv.dev

churchcrm software

sql injection

event attendance reports

7.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

8.2 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

60.1%

JSON

ChurchCRM v4.5.3 and below was discovered to contain a SQL injection vulnerability via the Event parameter under the Event Attendance reports module.

CPENameOperatorVersion
crmeq3.2.0
crmeq4.0.4
crmeq4.0.3
crmeq2.1.4
crmeq2.1.5
crmeq3.2.4
crmeq4.3.0
crmeq3.0.13
crmeq4.3.1
crmeq2.7.4

Name	Operator	Version
crm	eq	3.2.0
crm	eq	4.0.4
crm	eq	4.0.3
crm	eq	2.1.4
crm	eq	2.1.5
crm	eq	3.2.4
crm	eq	4.3.0
crm	eq	3.0.13
crm	eq	4.3.1
crm	eq	2.7.4

Rows per page:

1-10 of 1291

References

churchcrm.io/

packetstormsecurity.com/files/172047/ChurchCRM-4.5.3-SQL-Injection.html

github.com/blakduk/Advisories/blob/main/ChurchCRM/README.md

github.com/ChurchCRM/CRM/

7.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

8.2 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

60.1%

JSON

Related for OSV:CVE-2023-24685