ChurchCRM Boolean-Based and Time-Based Blind SQL Injection Vulnerability in DonatedItemEditor

A SQL injection vulnerability has been identified in ChurchCRM versions through 5.13.0. This vulnerability allows attackers to execute arbitrary SQL queries by exploiting a boolean-based and time-based blind SQL injection in the DonatedItemEditor functionality. The CurrentFundraiser parameter is concatenated into an SQL query without proper sanitization, enabling attackers to manipulate database queries and execute arbitrary commands. This could lead to unauthorized data exfiltration, modification, or deletion. Exploitation of this vulnerability requires administrator privileges.

Impact

Exploitation of this vulnerability could result in unauthorized SQL query execution, allowing attackers to exfiltrate, modify, or delete database information. Additionally, in some database configurations, this could lead to remote code execution.

Reproduction

To reproduce this vulnerability, navigate to the DonatedItemEditor.php endpoint with an active administrator session. Intercept the request and modify the CurrentFundraiser parameter to include a crafted SQL injection payload, such as one that exploits time-based blind SQL injection by using the SQL SLEEP function. Send the modified request and observe the response delay, which indicates successful exploitation.

Remediation

It is recommended to use prepared statements or parameterized queries to prevent SQL injection vulnerabilities. Implement input validation to reject potentially dangerous characters, and apply the principle of least privilege to database users to limit the potential impact of an SQL injection attack.