PT-2024-21187

Name of the Vulnerable Software and Affected Versions ChurchCRM version 5.5.0 Description The issue concerns a Blind SQL Injection vulnerability, specifically time-based, that can be exploited via the EventCount POST parameter in the /EventEditor.php endpoint. This allows for potential unauthoriz...

CVE-2024-25894

ChurchCRM 5.5.0 /EventEditor.php is vulnerable to Blind SQL Injection Time-based via the EventCount POST parameter...

CVE-2024-25896

ChurchCRM 5.5.0 EventEditor.php is vulnerable to Blind SQL Injection Time-based via the EID POST parameter...

CVE-2024-25894

ChurchCRM 5.5.0 /EventEditor.php is vulnerable to Blind SQL Injection Time-based via the EventCount POST parameter...

CVE-2024-25894

ChurchCRM 5.5.0 /EventEditor.php is vulnerable to Blind SQL Injection Time-based via the EventCount POST parameter...

CVE-2024-25891

The open-source church management system ChurchCRM version 5.5.0 is vulnerable to a Blind SQL Injection (Time-based) . The flaw exists in the FRBidSheets.php page due to improper neutralization of special elements in the CurrentFundraiser GET parameter. An attacker can exploit this by constructin...

CVE-2024-25892

The open-source CRM system ChurchCRM version 5.5.0 is vulnerable to a Blind SQL Injection (Time-based) . The root cause is the improper neutralization of special elements used in an SQL command within the ConfirmReport.php page, specifically via the familyId GET parameter. Exploitation of this vu...

CVE-2024-25894

ChurchCRM version 5.5.0 is vulnerable to a Blind SQL Injection (Time-based) flaw located in the /EventEditor.php page. The vulnerability is triggered via the EventCount POST parameter , allowing an attacker to execute arbitrary SQL commands. Exploitation details and specific remediation steps are...

CVE-2024-25897

ChurchCRM version 5.5.0 is vulnerable to a Blind SQL Injection (Time-based) vulnerability within the FRCatalog.php file. The flaw is triggered via the CurrentFundraiser GET parameter in the API endpoint. This vulnerability allows an attacker to potentially perform unauthorized database queries by...

CVE-2024-25891

ChurchCRM 5.5.0 FRBidSheets.php is vulnerable to Blind SQL Injection Time-based via the CurrentFundraiser GET parameter...

CVE-2024-25896

ChurchCRM 5.5.0 EventEditor.php is vulnerable to Blind SQL Injection Time-based via the EID POST parameter...

PT-2024-21184 · Churchcrm · Churchcrm

Name of the Vulnerable Software and Affected Versions: ChurchCRM version 5.5.0 Description: The issue concerns a Blind SQL Injection vulnerability, specifically time-based, that can be exploited via the CurrentFundraiser GET parameter in the FRBidSheets.php file. Recommendations: For ChurchCRM...

CVE-2024-25891: Improper Neutralization of Special Elements used in an SQL Command

ChurchCRM 5.5.0 FRBidSheets.php is vulnerable to Blind SQL Injection Time-based via the CurrentFundraiser GET parameter...

PT-2024-21185

Name of the Vulnerable Software and Affected Versions ChurchCRM version 5.5.0 Description The issue concerns a Blind SQL Injection vulnerability, specifically a time-based attack, that can be exploited via the familyId GET parameter in the ConfirmReport.php file. This allows an attacker to...

CVE-2024-25893

ChurchCRM 5.5.0 FRCertificates.php is vulnerable to Blind SQL Injection Time-based via the CurrentFundraiser GET parameter...

CVE-2024-25893

ChurchCRM version 5.5.0 is vulnerable to a Blind SQL Injection (Time-based) . The flaw exists in the FRCertificates.php page due to improper neutralization of special elements in the CurrentFundraiser GET parameter. This allows an attacker to potentially execute arbitrary SQL commands. Exploitati...

CVE-2024-25893: Improper Neutralization of Special Elements used in an SQL Command

ChurchCRM 5.5.0 FRCertificates.php is vulnerable to Blind SQL Injection Time-based via the CurrentFundraiser GET parameter...

CVE-2024-25893

ChurchCRM 5.5.0 FRCertificates.php is vulnerable to Blind SQL Injection Time-based via the CurrentFundraiser GET parameter...

CVE-2024-25893

ChurchCRM 5.5.0 FRCertificates.php is vulnerable to Blind SQL Injection Time-based via the CurrentFundraiser GET parameter...

CVE-2024-25894: Improper Neutralization of Special Elements used in an SQL Command

ChurchCRM 5.5.0 /EventEditor.php is vulnerable to Blind SQL Injection Time-based via the EventCount POST parameter...