Executive Summary

This vulnerability exists in ChurchCRM versions prior to 7.2.0. The family record deletion endpoint (SelectDelete.php) allows permanent and irreversible deletion of family records and all associated data through a simple GET request that lacks CSRF token validation.

An attacker can create a malicious webpage that, when visited by an authenticated administrator, silently triggers the deletion of targeted family records including notes, pledges, persons, and property data without any user interaction.

This means that an attacker can cause data loss by exploiting the lack of proper request validation.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to permanent and irreversible deletion of critical family records and all associated data in ChurchCRM.

• Loss of important data such as notes, pledges, persons, and property information.
• Data deletion can be triggered silently without the administrator's knowledge or consent.
• Potential disruption of church management operations due to missing data.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade ChurchCRM to version 7.2.0 or later, where the issue has been fixed.

Until the upgrade can be performed, restrict access to the family record deletion endpoint (SelectDelete.php) to trusted administrators only and avoid visiting untrusted or suspicious pages while authenticated as an administrator.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows an attacker to permanently and irreversibly delete family records and all associated data without proper authorization or user interaction. This could lead to loss of critical personal data managed by the system.

Such unauthorized data deletion may impact compliance with data protection regulations like GDPR and HIPAA, which require proper safeguards to protect personal data integrity and availability.

Specifically, the lack of CSRF token validation and the use of a plain GET request to perform deletions could be seen as insufficient security controls, potentially violating principles of data protection and accountability.

Useful 0 Not Useful 0