S4E just found a high-severity finding from top 10 tcp port service scan
PlatformPlansPartners
Resources
ToolsBlogDocs
Sign Up →
critical·Product Based Web Vulnerabilities·Updated Nov 5, 2025

CVE-2025-1023 Scanner

CVE-2025-1023 Scanner - SQL Injection vulnerability in ChurchCRM

Est. Time~10 seconds
Scan TypeSingle Scan
Targetsdomain, subdomain, ipv4
CostFree
2.3k
Times Used
continuous scan runs
5.8k
Continuously Checked
assets under CS
0
Vulnerabilities Found
confirmed findings
References
CVECVE-2025-1023
9.3
CVSScritical
Exploitable remotely over the internet · requires high privileges.

A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to execute arbitrary SQL queries by exploiting a time-based blind SQL Injection vulnerability in the EditEventTypes functionality. The newCountName parameter is directly concatenated into an SQL query without proper sanitization, allowing an attacker to manipulate database queries and execute arbitrary commands, potentially leading to data exfiltration, modification, or deletion.

Attack Vector
Network
Privileges Req.
High
User Interaction
None
Affected
ChurchCRMby ChurchCRM
ChurchCRM 5.13.0 and prior
Updated Sep 9, 2026View on NVD →
Detail

ChurchCRM is an open-source management software used primarily in churches and religious organizations to handle member information, event scheduling, and donations. Widely adopted by both small and large communities, it aids in streamlining various administrative tasks. ChurchCRM offers features like contribution tracking, Sunday school management, and member directory assistance. It is typically deployed on web servers accessible over the internet, providing convenience in managing church data remotely. Given its integration capabilities, it helps in maintaining a real-time record of all church-related activities.

SQL Injection is a critical vulnerability that allows attackers to execute arbitrary SQL queries on a database. In the case of ChurchCRM, the vulnerability exists within the EditEventTypes functionality. The newCountName parameter is improperly sanitized, leaving it susceptible to manipulation. An attacker can exploit this to execute commands on the underlying database, potentially leading to data modification or exfiltration. The primary risk lies in unauthorized access and control over sensitive church data.

The vulnerability is particularly centered around the EditEventTypes.php endpoint in the ChurchCRM application. Attackers manipulate the newCountName parameter in SQL queries through unsanitized user input. By injecting a payload into this parameter, attackers can execute commands that trigger time-based actions, confirmed by changes in response times. The application's reliance on direct concatenation in SQL statements without sanitation opens it up to this SQL Injection risk.

Exploiting this vulnerability gives attackers the capability to access and modify sensitive data, which can include church member information and financial records. Data exfiltration can lead to privacy breaches affecting church members, and falsified data entries could disrupt administrative operations. Long-term exploitation might result in data deletion or even entire database compromise, severely impacting church operations.

REFERENCES

Solution Advice
  • Sanitize all user inputs using parameterized queries or prepared statements to avoid SQL Injection risks.
  • Implement input validation techniques to further ensure data integrity before processing queries.
  • Regularly update and patch ChurchCRM to mitigate discovered vulnerabilities promptly.
  • Restrict database permissions to limit exposure in case of an attack attempt.
  • Conduct regular security audits and penetration tests to identify and resolve potential vulnerabilities.

Get AI-powered remediation steps tailored to your asset.

Try AI Solutions →

Check your infrastructure.
Right now.

11,000+ scanners. Free to start. No credit card required.

CVE-2025-1023 Scanner - SQL Injection vulnerability in ChurchCRM | S4E