What’s Vulnerable › Vulnerabilities

CVE-2025-68400: ChurchCRM vulnerable to time-based blind SQL Injection in ConfirmReportEmail.php

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-12-17 · updated 2026-06-17
• Weakness: CWE-89

Description

ChurchCRM is an open-source church management system. A SQL Injection vulnerability exists in the legacy endpoint `/Reports/ConfirmReportEmail.php` in ChurchCRM prior to version 6.5.3. Although the feature was removed from the UI, the file remains deployed and reachable directly via URL. This is a classic case of *dead but reachable code*. Any authenticated user - including one with zero assigned permissions - can exploit SQL injection through the `familyId` parameter. Version 6.5.3 fixes the issue.

Affected products

• ChurchCRM CRM: before 6.5.3 — fixed in 6.5.3

How to fix

Upgrade to a fixed version: ChurchCRM CRM 6.5.3. Check the vendor advisory for mitigations.

References

• https://github.com/ChurchCRM/CRM/security/advisories/GHSA-v54g-2pvg-gvp2
• https://github.com/ChurchCRM/CRM/security/advisories/GHSA-v54g-2pvg-gvp2

Get alerted when CVE-2025-68400 or the next vulnerability affects your stack