ChurchCRM Database Information Disclosure Vulnerability

A vulnerability in ChurchCRM versions prior to 6.5.3 allows for the unintentional disclosure of database connection details in error messages. This information leak includes the database host, IP address, username, and password. The issue arises when the application encounters a database error and fails to properly handle the exception, leading to sensitive information being exposed.

Impact

Exploitation of this vulnerability allows unauthorized access to the SQL server using the disclosed credentials. This access could lead to further compromise of the SQL server, which is considered a separate security authority from the web application. As a result, the vulnerability's impact extends beyond the application's security boundary, affecting an external system.

Remediation

Users can upgrade to ChurchCRM version 6.5.3 or later to address this vulnerability.