CVE-2024-53438

EventAttendance.php in ChurchCRM 5.7.0 is vulnerable to SQL injection. An attacker can exploit this vulnerability by manipulating the 'Event' parameter, which is directly interpolated into the SQL query without proper sanitization or validation, allowing attackers to execute arbitrary SQL commands.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/ChurchCRM/CRM/issues/6988	Issue Tracking Vendor Advisory
https://github.com/advisories/GHSA-gr5x-8j97-qq23	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:churchcrm:churchcrm:5.7.0:*:*:*:*:*:*:*

History

28 Mar 2025, 16:39

Type	Values Removed	Values Added
References	~~() https://github.com/ChurchCRM/CRM/issues/6988 -~~	() https://github.com/ChurchCRM/CRM/issues/6988 - Issue Tracking, Vendor Advisory
References	~~() https://github.com/advisories/GHSA-gr5x-8j97-qq23 -~~	() https://github.com/advisories/GHSA-gr5x-8j97-qq23 - Third Party Advisory
First Time		Churchcrm churchcrm Churchcrm
CPE		cpe:2.3:a:churchcrm:churchcrm:5.7.0:::::::*

03 Feb 2025, 19:15

Type	Values Removed	Values Added
References		() https://github.com/advisories/GHSA-gr5x-8j97-qq23 -

Information

Published : 2024-11-22 17:15

Updated : 2025-03-28 16:39

NVD link : CVE-2024-53438

Mitre link : CVE-2024-53438

CVE.ORG link : CVE-2024-53438

JSON object : View

Products Affected

churchcrm

churchcrm

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2024-53438", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2024-11-22T17:15:10.857", "references": [{"url": "https://github.com/ChurchCRM/CRM/issues/6988", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/advisories/GHSA-gr5x-8j97-qq23", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-89"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "EventAttendance.php in ChurchCRM 5.7.0 is vulnerable to SQL injection. An attacker can exploit this vulnerability by manipulating the 'Event' parameter, which is directly interpolated into the SQL query without proper sanitization or validation, allowing attackers to execute arbitrary SQL commands."}, {"lang": "es", "value": "EventAttendance.php en ChurchCRM 5.7.0 es vulnerable a la inyecci\u00f3n SQL. Un atacante puede aprovechar esta vulnerabilidad manipulando el par\u00e1metro 'Event', que se interpola directamente en la consulta SQL sin la debida desinfecci\u00f3n o validaci\u00f3n, lo que permite a los atacantes ejecutar comandos SQL arbitrarios."}], "lastModified": "2025-03-28T16:39:27.213", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:churchcrm:churchcrm:5.7.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C9531F85-4051-48B3-B092-C2E13496FEDA"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}