CVE-2023-38770

SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the group parameter within the /QueryView.php...

ChurchCRM SQL注入漏洞

ChurchCRM is an open source CRM system for churches. ChurchCRM version v5.0.0 suffers from a SQL injection vulnerability that stems from the lack of validation of externally entered SQL statements in the group parameter of QueryView.php. An attacker can exploit this vulnerability to execute illeg...

PT-2023-26600 · Churchcrm · Churchcrm

Name of the Vulnerable Software and Affected Versions: ChurchCRM version 5.0.0 Description: The issue allows a remote attacker to obtain sensitive information via the volopp parameter within the "/QueryView.php" API endpoint. This enables the attacker to inject SQL code, potentially leading to...

CVE-2023-38770: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the group parameter within the /QueryView.php...

CVE-2023-38771: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the volopp parameter within the /QueryView.php...

CVE-2023-38768: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the PropertyID parameter within the /QueryView.php...

CVE-2023-38762: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the friendmonths parameter within the /QueryView.php...

CVE-2023-38764: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the birthmonth and percls parameters within the /QueryView.php...

CVE-2023-38768

SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the PropertyID parameter within the /QueryView.php...

CVE-2023-38771

SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the volopp parameter within the /QueryView.php...

CVE-2023-38767: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the 'value' and 'custom' parameters within the /QueryView.php...

CVE-2023-38768

SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the PropertyID parameter within the /QueryView.php...

CVE-2023-38769: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the searchstring and searchwhat parameters within the /QueryView.php...

PT-2023-26597 · Churchcrm · Churchcrm

Name of the Vulnerable Software and Affected Versions: ChurchCRM version 5.0.0 Description: The issue allows a remote attacker to obtain sensitive information via the searchstring and searchwhat parameters within the "/QueryView.php" API endpoint. Recommendations: For ChurchCRM version 5.0.0,...

PT-2023-26592

Name of the Vulnerable Software and Affected Versions ChurchCRM version 5.0.0 Description A SQL injection issue allows a remote attacker to obtain sensitive information via the birthmonth and percls parameters within the "/QueryView.php" API endpoint. Recommendations For ChurchCRM version 5.0.0,...

CVE-2023-38768

SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the PropertyID parameter within the /QueryView.php...

CVE-2023-38762

ChurchCRM v5.0.0 is affected by a SQL injection in the friendmonths parameter of QueryView.php. The vulnerability, described across CNVD and other sources as stemming from insufficient validation of externally supplied SQL, allows remote attackers to potentially exfiltrate data. Connected documen...

CVE-2023-38768

CVE-2023-38768 describes a SQL injection in ChurchCRM v5.0.0, where the vulnerability is exploitable via the PropertyID parameter in /QueryView.php. The connected documents confirm this classic information disclosure vulnerability without detailing exploit access or availability of a patch. Impac...

PT-2023-26590

Name of the Vulnerable Software and Affected Versions ChurchCRM version 5.0.0 Description A SQL injection issue allows a remote attacker to obtain sensitive information via the friendmonths parameter within the "/QueryView.php" API endpoint. Recommendations For ChurchCRM version 5.0.0, consider...

CVE-2023-38762

SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the friendmonths parameter within the /QueryView.php...