SQL Injection vulnerability in ChurchCRM 4.4.5 via /churchcrm/WhyCameEditor.php

[tuando243]

SQL Injection vulnerability in ChurchCRM 4.4.5 via /churchcrm/WhyCameEditor.php.

Step to exploit:

1. Login as admin.

2. Redirect to profile page and click on Edit "Why Came" Notes.
   

3. Submit "Why Came" notes and capture request in Burp Suite.
   

4. Save request to churchcrm.txt file and run sqlmap for injecting the PersonID parameter: sqlmap -r churchcrm.txt -p PersonID
   
   

[PavelBlinnikov]

Isn't admin allowed to make arbitrary SQL queries using QuerySQL.php?

[MrClever]

Isn't admin allowed to make arbitrary SQL queries using QuerySQL.php?

Correct. However, we should be sanitising input appropriately on forms etc. Personally, I'm not a huge fan of the QuerySQL.php but it has made some support cases a lot easier - especially when not all admins are comfortable with phpMyAdmin or CLI MySQL tools.

@tuando243 - thanks for the report. I've categorised it as a security bug, but as it requires authenticated access it has limited risk to most setups (except our demo system!).

[github-actions]

This issue is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 5 days.

[github-actions]

This issue is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 5 days.

[github-actions]

This issue is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 5 days.