Code injection

2023-02-0922:15:00

PRIOn knowledge base

www.prio-n.com

csv import

churchcrm v4.5.3

code execution

security vulnerability

5.7 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

31.0%

An issue in the CSV Import function of ChurchCRM v4.5.3 and below allows attackers to execute arbitrary code via importing a crafted CSV file.

CPENameOperatorVersion
churchcrmle4.5.3

CPE	Name	Operator	Version
	churchcrm	le	4.5.3

References

churchcrm.io/

github.com/blakduk/Advisories/blob/main/ChurchCRM/README.md

github.com/ChurchCRM/CRM