CVE-2026-39330
SQL Injection in ChurchCRM /PropertyAssign.php Allows Data Manipulation
Publication date: 2026-04-07
Last updated on: 2026-04-10
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| churchcrm | churchcrm | to 7.1.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-39330 is a high-severity blind SQL injection vulnerability found in ChurchCRM version 7.0.5, specifically in the /PropertyAssign.php endpoint.
Authenticated users with the roles "Manage Groups & Roles" and "Edit Records" can inject arbitrary SQL commands through the POST parameter "Value." This happens because the input is only sanitized to prevent XSS but not properly escaped for SQL, allowing malicious SQL code to be executed.
The vulnerability allows attackers to extract and modify information from the database by embedding unsanitized input directly into SQL INSERT or UPDATE statements.
How can this vulnerability impact me? :
This vulnerability can lead to a complete compromise of the ChurchCRM database.
- Unauthorized extraction of sensitive data stored in the database.
- Modification or deletion of database records.
- Potential privilege escalation within the application.
- Possible remote code execution depending on the SQL functions and server configuration.
The vulnerability requires only low privileges (authenticated user with specific roles) and no user interaction, making it easier to exploit remotely.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by testing the /PropertyAssign.php endpoint for SQL injection via the POST parameter "Value". Authenticated users with the required roles can attempt to inject SQL payloads to verify if the system is vulnerable.
A practical approach is to use automated SQL injection testing tools such as sqlmap targeting the endpoint with appropriate authentication and parameters.
- Use sqlmap with a POST request including parameters: SecondPass=True, Action=edit, and a crafted Value payload to test for SQL injection.
- Example sqlmap command: sqlmap -u "http://target/PropertyAssign.php" --data="SecondPass=True&Action=edit&Value=payload" --cookie="session=your_session_cookie" --level=5 --risk=3
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade ChurchCRM to version 7.1.0 or later, where this SQL injection vulnerability has been fixed.
Until the upgrade can be performed, restrict access to the /PropertyAssign.php endpoint to only trusted users and limit the roles that have the Manage Groups & Roles and Edit Records privileges.
Additionally, monitor and audit logs for suspicious activity involving the /PropertyAssign.php endpoint and the Value parameter.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The SQL injection vulnerability in ChurchCRM allows unauthorized extraction and modification of sensitive data from the database, which can lead to a complete database compromise. This exposure of sensitive information can negatively impact compliance with data protection regulations such as GDPR and HIPAA, which require the protection of personal and sensitive data against unauthorized access and modification.
Because the vulnerability enables attackers to read, write, and delete sensitive data, it increases the risk of data breaches and unauthorized data manipulation, both of which are critical compliance concerns under these regulations.