Executive Summary

CVE-2026-39318 is a critical SQL injection vulnerability found in ChurchCRM versions 7.0.5 and earlier, specifically in the GroupPropsFormRowOps.php file.

The vulnerability occurs because user input from the "Field" parameter is directly inserted into SQL queries without proper sanitization. The function mysqli_real_escape_string() used to sanitize input does not escape backtick (`) characters, which allows attackers to break out of the SQL identifier context.

This enables attackers to execute arbitrary SQL commands, such as dropping database tables or modifying data.

To exploit this vulnerability, an attacker must have a valid ChurchCRM user account with the "ManageGroups" permission and target a group where grp_hasSpecialProps=1. The "Field" parameter must correspond to a property registered in the groupprop_master table.

The issue was fixed in ChurchCRM version 7.1.0 by validating the "Field" parameter against a whitelist of valid fields.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts on the confidentiality, integrity, and availability of your ChurchCRM system.

An attacker exploiting this SQL injection can execute arbitrary SQL commands, which may include dropping database tables, modifying or deleting data, and gaining unauthorized access to sensitive information.

Because the attack requires only low complexity, low privileges, and no user interaction, it poses a significant risk to systems running vulnerable versions.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for suspicious HTTP GET requests targeting the GroupPropsFormRowOps.php file with crafted 'Field' parameters that include SQL injection payloads, such as backtick characters and SQL commands (e.g., `Field=c1`; DROP TABLE injection_proof_table#`).

Detection can involve inspecting web server logs or using network monitoring tools to identify such malicious requests.

Example commands to detect potential exploitation attempts include using grep on web server logs:

• grep 'GroupPropsFormRowOps.php' /var/log/apache2/access.log | grep 'Field='
• grep -E 'Field=.*`|Field=.*DROP|Field=.*;|Field=.*#' /var/log/apache2/access.log

Additionally, using intrusion detection systems (IDS) with SQL injection signatures or web application firewalls (WAF) can help detect and alert on such malicious inputs.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade ChurchCRM to version 7.1.0 or later, where this SQL injection vulnerability in GroupPropsFormRowOps.php has been fixed.

Until the upgrade can be performed, restrict access to the affected functionality by limiting user permissions, especially the 'ManageGroups' permission, to trusted users only.

Implement input validation by ensuring the 'Field' parameter is validated against a whitelist of valid fields retrieved from the groupprop_master table, rejecting any input not in this list.

Consider deploying web application firewalls (WAF) or intrusion prevention systems (IPS) to block malicious SQL injection attempts targeting this vulnerability.

Useful 0 Not Useful 0

Compliance Impact

The SQL injection vulnerability in ChurchCRM allows attackers to execute arbitrary SQL commands, potentially compromising the confidentiality, integrity, and availability of the system's data.

Such a compromise can lead to unauthorized access, modification, or deletion of sensitive data, which may include personal or protected information managed by the system.

This poses a risk to compliance with common standards and regulations like GDPR and HIPAA, which require organizations to protect personal and sensitive data against unauthorized access and ensure data integrity and availability.

Failure to address this vulnerability could result in violations of these regulations, potentially leading to legal penalties, reputational damage, and loss of trust.

Useful 0 Not Useful 0