CVE-2025-68110
BaseFortify
Publication date: 2025-12-17
Last updated on: 2025-12-18
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| churchcrm | churchcrm | to 6.5.3 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-200 | The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. |
| CWE-209 | The product generates an error message that includes sensitive information about its environment, users, or associated data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in ChurchCRM versions prior to 6.5.3 causes the system to disclose sensitive database information in error messages. The exposed information can include the database host, IP address, username, and password. This issue was fixed in version 6.5.3.
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized access to the database by exposing critical credentials and connection details. This can result in a complete compromise of confidentiality, integrity, and availability of the system and its data.
What immediate steps should I take to mitigate this vulnerability?
Upgrade ChurchCRM to version 6.5.3 or later, as this version fixes the issue of database information disclosure in error messages.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability exposes sensitive database credentials, which can lead to unauthorized access to confidential data. Such exposure likely violates data protection requirements in standards like GDPR and HIPAA, which mandate safeguarding personal and sensitive information against unauthorized disclosure. Therefore, the vulnerability negatively impacts compliance with these regulations by risking data confidentiality and security. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by triggering database errors in ChurchCRM versions prior to 6.5.3 and observing if detailed database connection credentials (host, IP, username, password) are disclosed in error messages. On the system, you can monitor web server logs or application logs for error messages containing sensitive database information. Network detection can involve inspecting HTTP responses for error messages that leak database credentials. Specific commands depend on your environment, but for example, using curl to send requests that cause database errors and grep to search for sensitive info in responses: curl -i http://your-churchcrm-instance/path-that-causes-db-error | grep -iE 'host|ip|username|password'. Additionally, checking logs with commands like grep -iE 'host|ip|username|password' /var/log/apache2/error.log or equivalent can help detect the vulnerability. [1]