CVE-2026-6628
SQL Injection in Ecclesia CRM Query Viewer Enables Remote Exploit
Publication date: 2026-04-20
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| phili67 | ecclesia_crm | to 8.0.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-74 | The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. |
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a flaw in the phili67 Ecclesia CRM software, specifically in the ValidateInput function of the Query Viewer Component located in the /v2/query/view/ file. The flaw allows an attacker to manipulate the 'custom' argument, which leads to a SQL injection vulnerability. This means that an attacker can remotely inject malicious SQL code into the system.
How can this vulnerability impact me? :
The vulnerability allows remote attackers to perform SQL injection attacks, which can lead to unauthorized access to the database. This can result in data leakage, data modification, or disruption of the affected system's operations. Since the exploit has been published and the vendor did not respond, the risk of exploitation is higher.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows for SQL injection leading to potential full database exfiltration, including sensitive personal data. This poses a high confidentiality risk and could result in unauthorized access to personal and sensitive information.
Such unauthorized access and potential data breaches can lead to non-compliance with data protection regulations like GDPR and HIPAA, which mandate the protection of personal and sensitive data against unauthorized access and disclosure.
Therefore, exploitation of this vulnerability could result in violations of these standards due to compromised confidentiality and integrity of protected data.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by testing the vulnerable endpoint /v2/query/view/{id} for SQL injection by submitting crafted POST requests with malicious parameters.
A common detection method is to attempt a UNION-based SQL injection using the 'custom' parameter in a POST request to see if database information can be extracted.
For example, you can use the following curl command to test for the vulnerability:
- curl -X POST -d "custom=per_ID AND 1=0 UNION SELECT 1, CONCAT(usr_UserName, ':', usr_Password), 3 FROM user_usr -- -" https://target-ecclesiacrm/v2/query/view/200
If the response contains concatenated usernames and password hashes, it indicates the presence of the SQL injection vulnerability.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include:
- Replace manual string substitution in the code with parameterized queries (prepared statements) using PDO or MySQLi to prevent SQL injection.
- Enhance input validation in the ValidateInput() function by sanitizing inputs using mysqli_real_escape_string() or type casting as a temporary measure.
- Remove the code that outputs the full SQL query in HTML comments to prevent information leakage.
These steps help prevent exploitation until a full patch or update can be applied.