CVE-2025-68110
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-12-17

Last updated on: 2025-12-18

Assigner: GitHub, Inc.

Description
ChurchCRM is an open-source church management system. Versions prior to 6.5.3 may disclose database information in an error message including the host, ip, username, and password. Version 6.5.3 fixes the issue.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-12-17
Last Modified
2025-12-18
Generated
2026-06-16
AI Q&A
2025-12-18
EPSS Evaluated
2026-06-15
NVD
CVE-2025-68110
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
churchcrm churchcrm to 6.5.3 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-209 The product generates an error message that includes sensitive information about its environment, users, or associated data.
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability in ChurchCRM versions prior to 6.5.3 causes the system to disclose sensitive database information in error messages. The exposed information can include the database host, IP address, username, and password. This issue was fixed in version 6.5.3.

Impact Analysis

The vulnerability can lead to unauthorized access to the database by exposing critical credentials and connection details. This can result in a complete compromise of confidentiality, integrity, and availability of the system and its data.

Mitigation Strategies

Upgrade ChurchCRM to version 6.5.3 or later, as this version fixes the issue of database information disclosure in error messages.

Compliance Impact

This vulnerability exposes sensitive database credentials, which can lead to unauthorized access to confidential data. Such exposure likely violates data protection requirements in standards like GDPR and HIPAA, which mandate safeguarding personal and sensitive information against unauthorized disclosure. Therefore, the vulnerability negatively impacts compliance with these regulations by risking data confidentiality and security. [1]

Detection Guidance

This vulnerability can be detected by triggering database errors in ChurchCRM versions prior to 6.5.3 and observing if detailed database connection credentials (host, IP, username, password) are disclosed in error messages. On the system, you can monitor web server logs or application logs for error messages containing sensitive database information. Network detection can involve inspecting HTTP responses for error messages that leak database credentials. Specific commands depend on your environment, but for example, using curl to send requests that cause database errors and grep to search for sensitive info in responses: curl -i http://your-churchcrm-instance/path-that-causes-db-error | grep -iE 'host|ip|username|password'. Additionally, checking logs with commands like grep -iE 'host|ip|username|password' /var/log/apache2/error.log or equivalent can help detect the vulnerability. [1]

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-68110. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart