CVE-2025-68110

Unknown Unknown - Not Provided

BaseFortify

Publication date: 2025-12-17

Last updated on: 2025-12-18

Assigner: GitHub, Inc.

Description

ChurchCRM is an open-source church management system. Versions prior to 6.5.3 may disclose database information in an error message including the host, ip, username, and password. Version 6.5.3 fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-17

Last Modified

2025-12-18

Generated

2026-07-06

AI Q&A

2025-12-18

EPSS Evaluated

2026-07-05

NVD

CVE-2025-68110

Affected Vendors & Products

Vendor	Product	Version / Range
churchcrm	churchcrm	to 6.5.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-209	The product generates an error message that includes sensitive information about its environment, users, or associated data.

Attack-Flow Graph

Executive Summary

This vulnerability in ChurchCRM versions prior to 6.5.3 causes the system to disclose sensitive database information in error messages. The exposed information can include the database host, IP address, username, and password. This issue was fixed in version 6.5.3.

Impact Analysis

The vulnerability can lead to unauthorized access to the database by exposing critical credentials and connection details. This can result in a complete compromise of confidentiality, integrity, and availability of the system and its data.

Mitigation Strategies

Upgrade ChurchCRM to version 6.5.3 or later, as this version fixes the issue of database information disclosure in error messages.

Compliance Impact

This vulnerability exposes sensitive database credentials, which can lead to unauthorized access to confidential data. Such exposure likely violates data protection requirements in standards like GDPR and HIPAA, which mandate safeguarding personal and sensitive information against unauthorized disclosure. Therefore, the vulnerability negatively impacts compliance with these regulations by risking data confidentiality and security. [1]

Detection Guidance

This vulnerability can be detected by triggering database errors in ChurchCRM versions prior to 6.5.3 and observing if detailed database connection credentials (host, IP, username, password) are disclosed in error messages. On the system, you can monitor web server logs or application logs for error messages containing sensitive database information. Network detection can involve inspecting HTTP responses for error messages that leak database credentials. Specific commands depend on your environment, but for example, using curl to send requests that cause database errors and grep to search for sensitive info in responses: curl -i http://your-churchcrm-instance/path-that-causes-db-error | grep -iE 'host|ip|username|password'. Additionally, checking logs with commands like grep -iE 'host|ip|username|password' /var/log/apache2/error.log or equivalent can help detect the vulnerability. [1]

Hi! I’m here to help you understand CVE-2025-68110. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70