CVE-2026-39318
SQL Injection in ChurchCRM GroupPropsFormRowOps.php Allows Data Manipulation
Publication date: 2026-04-07
Last updated on: 2026-04-15
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| churchcrm | churchcrm | to 7.0.5 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-39318 is a critical SQL injection vulnerability found in ChurchCRM versions 7.0.5 and earlier, specifically in the GroupPropsFormRowOps.php file.
The vulnerability occurs because user input from the "Field" parameter is directly inserted into SQL queries without proper sanitization. The function mysqli_real_escape_string() used to sanitize input does not escape backtick (`) characters, which allows attackers to break out of the SQL identifier context.
This enables attackers to execute arbitrary SQL commands, such as dropping database tables or modifying data.
To exploit this vulnerability, an attacker must have a valid ChurchCRM user account with the "ManageGroups" permission and target a group where grp_hasSpecialProps=1. The "Field" parameter must correspond to a property registered in the groupprop_master table.
The issue was fixed in ChurchCRM version 7.1.0 by validating the "Field" parameter against a whitelist of valid fields.
How can this vulnerability impact me? :
This vulnerability can have severe impacts on the confidentiality, integrity, and availability of your ChurchCRM system.
An attacker exploiting this SQL injection can execute arbitrary SQL commands, which may include dropping database tables, modifying or deleting data, and gaining unauthorized access to sensitive information.
Because the attack requires only low complexity, low privileges, and no user interaction, it poses a significant risk to systems running vulnerable versions.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for suspicious HTTP GET requests targeting the GroupPropsFormRowOps.php file with crafted 'Field' parameters that include SQL injection payloads, such as backtick characters and SQL commands (e.g., `Field=c1`; DROP TABLE injection_proof_table#`).
Detection can involve inspecting web server logs or using network monitoring tools to identify such malicious requests.
Example commands to detect potential exploitation attempts include using grep on web server logs:
- grep 'GroupPropsFormRowOps.php' /var/log/apache2/access.log | grep 'Field='
- grep -E 'Field=.*`|Field=.*DROP|Field=.*;|Field=.*#' /var/log/apache2/access.log
Additionally, using intrusion detection systems (IDS) with SQL injection signatures or web application firewalls (WAF) can help detect and alert on such malicious inputs.
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade ChurchCRM to version 7.1.0 or later, where this SQL injection vulnerability in GroupPropsFormRowOps.php has been fixed.
Until the upgrade can be performed, restrict access to the affected functionality by limiting user permissions, especially the 'ManageGroups' permission, to trusted users only.
Implement input validation by ensuring the 'Field' parameter is validated against a whitelist of valid fields retrieved from the groupprop_master table, rejecting any input not in this list.
Consider deploying web application firewalls (WAF) or intrusion prevention systems (IPS) to block malicious SQL injection attempts targeting this vulnerability.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The SQL injection vulnerability in ChurchCRM allows attackers to execute arbitrary SQL commands, potentially compromising the confidentiality, integrity, and availability of the system's data.
Such a compromise can lead to unauthorized access, modification, or deletion of sensitive data, which may include personal or protected information managed by the system.
This poses a risk to compliance with common standards and regulations like GDPR and HIPAA, which require organizations to protect personal and sensitive data against unauthorized access and ensure data integrity and availability.
Failure to address this vulnerability could result in violations of these regulations, potentially leading to legal penalties, reputational damage, and loss of trust.