Vulnerability · Published Dec 17, 2025 · Assigned by GitHub_M
CVE-2025-68112ChurchCRM has SQL injection in EditEventAttendees.php
Critical 9.6
In plain English
A critical-severity SQL injection in CRM from ChurchCRM. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities).
Official description
ChurchCRM is an open-source church management system. In versions prior to 6.5.3, a SQL injection vulnerability in ChurchCRM's Event Attendee Editor allows authenticated users to execute arbitrary SQL commands, leading to complete database compromise, administrative credential theft, and potential system takeover. The vulnerability enables attackers to extract sensitive member data, authentication credentials, and financial information from the church management system. Version 6.5.3 contains a patch for the issue.
Affected products (as reported)
Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
References
- https://github.com/ChurchCRM/CRM/security/advisories/GHSA-hxf4-3vhp-wqcq x_refsource_CONFIRM