Executive Summary

CVE-2026-39330 is a high-severity blind SQL injection vulnerability found in ChurchCRM version 7.0.5, specifically in the /PropertyAssign.php endpoint.

Authenticated users with the roles "Manage Groups & Roles" and "Edit Records" can inject arbitrary SQL commands through the POST parameter "Value." This happens because the input is only sanitized to prevent XSS but not properly escaped for SQL, allowing malicious SQL code to be executed.

The vulnerability allows attackers to extract and modify information from the database by embedding unsanitized input directly into SQL INSERT or UPDATE statements.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to a complete compromise of the ChurchCRM database.

• Unauthorized extraction of sensitive data stored in the database.
• Modification or deletion of database records.
• Potential privilege escalation within the application.
• Possible remote code execution depending on the SQL functions and server configuration.

The vulnerability requires only low privileges (authenticated user with specific roles) and no user interaction, making it easier to exploit remotely.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by testing the /PropertyAssign.php endpoint for SQL injection via the POST parameter "Value". Authenticated users with the required roles can attempt to inject SQL payloads to verify if the system is vulnerable.

A practical approach is to use automated SQL injection testing tools such as sqlmap targeting the endpoint with appropriate authentication and parameters.

• Use sqlmap with a POST request including parameters: SecondPass=True, Action=edit, and a crafted Value payload to test for SQL injection.
• Example sqlmap command: sqlmap -u "http://target/PropertyAssign.php" --data="SecondPass=True&Action=edit&Value=payload" --cookie="session=your_session_cookie" --level=5 --risk=3

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade ChurchCRM to version 7.1.0 or later, where this SQL injection vulnerability has been fixed.

Until the upgrade can be performed, restrict access to the /PropertyAssign.php endpoint to only trusted users and limit the roles that have the Manage Groups & Roles and Edit Records privileges.

Additionally, monitor and audit logs for suspicious activity involving the /PropertyAssign.php endpoint and the Value parameter.

Useful 0 Not Useful 0

Compliance Impact

The SQL injection vulnerability in ChurchCRM allows unauthorized extraction and modification of sensitive data from the database, which can lead to a complete database compromise. This exposure of sensitive information can negatively impact compliance with data protection regulations such as GDPR and HIPAA, which require the protection of personal and sensitive data against unauthorized access and modification.

Because the vulnerability enables attackers to read, write, and delete sensitive data, it increases the risk of data breaches and unauthorized data manipulation, both of which are critical compliance concerns under these regulations.

Useful 0 Not Useful 0