CVE-2024-3538: Church Management System SQL Injection Flaw

CVE-2024-3538 Overview

CVE-2024-3538 is a SQL injection vulnerability in Campcodes Church Management System 1.0. The flaw resides in /admin/addTithes.php, where the na parameter is passed to a backend database query without proper sanitization. An authenticated remote attacker can manipulate the parameter to inject arbitrary SQL statements. The exploit has been publicly disclosed, increasing the likelihood of opportunistic attacks against exposed installations. The vulnerability is tracked in VulDB as entry VDB-259908 and classified under CWE-89: Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
Successful exploitation allows attackers to read, modify, or destroy church member records, credentials, and financial tithe data stored in the backend database.

Affected Products

Campcodes Church Management System 1.0
CPE: cpe:2.3:a:campcodes:church_management_system:1.0
Component: /admin/addTithes.php

Discovery Timeline

2024-04-10 - CVE-2024-3538 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-3538

Vulnerability Analysis

The vulnerability affects the tithe management workflow of Campcodes Church Management System 1.0. When an authenticated user submits data through /admin/addTithes.php, the application concatenates the na request parameter directly into a SQL statement. No parameterized queries, prepared statements, or input escaping routines protect the query before execution.

An attacker with low-privilege access to the admin panel can supply crafted SQL fragments through the na argument. The database engine executes these fragments as part of the intended query. Depending on the underlying MySQL user privileges, an attacker can enumerate schemas, dump credential hashes, alter tithe records, or plant persistent web content through INTO OUTFILE primitives.

The exploit is reachable over the network and requires no user interaction beyond a valid session, aligning with attack complexity considered low.

Root Cause

The root cause is missing input neutralization on the na parameter before it reaches the database layer. The code path builds SQL strings through concatenation rather than binding parameters, which is a textbook CWE-89 pattern common to legacy PHP applications.

Attack Vector

An attacker sends an HTTP request to /admin/addTithes.php with a malicious payload in the na parameter. The payload uses standard SQL injection techniques such as boolean-based blind, union-based extraction, or time-based inference to retrieve data or manipulate rows. Automated tooling such as sqlmap can weaponize the vulnerability once a valid session cookie is provided. The current EPSS probability is 0.882%.

See the GitHub Vulnerability Report and the VulDB CVE Database Entry for the disclosed proof-of-concept details.

Detection Methods for CVE-2024-3538

Indicators of Compromise

POST or GET requests to /admin/addTithes.php containing SQL metacharacters such as ', --, UNION SELECT, SLEEP(, or INFORMATION_SCHEMA in the na parameter.
Web server logs showing anomalously long na values or repeated requests from a single source with incremental payload variations.
MySQL error messages referencing syntax errors originating from the tithe insertion query.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the na parameter for SQL injection signatures on the /admin/addTithes.php endpoint.
Enable database query logging and alert on unexpected UNION, INFORMATION_SCHEMA, or BENCHMARK statements issued by the church management application user.
Correlate authentication events with subsequent bursts of parameterized requests to admin endpoints.

Monitoring Recommendations

Monitor egress traffic from the web server for large or encoded database dumps.
Track admin account logins from unfamiliar IP addresses or geographies followed by activity on /admin/addTithes.php.
Audit the tithes and user tables for unauthorized modifications or new administrative accounts.

How to Mitigate CVE-2024-3538

Immediate Actions Required

Restrict access to /admin/ paths using network ACLs, VPN, or IP allowlists until a fix is applied.
Rotate all administrative credentials and database service account passwords for the application.
Review the tithes table and related tables for evidence of tampering or unauthorized inserts.

Patch Information

No vendor patch is listed in the referenced advisories at the time of publication. Organizations running Campcodes Church Management System 1.0 should contact the vendor for remediation guidance and monitor the VulDB entry for updates.

Workarounds

Place the application behind a WAF configured to block SQL injection payloads targeting the na parameter.
Modify /admin/addTithes.php to use parameterized queries with PDO or mysqli prepared statements instead of string concatenation.
Apply the principle of least privilege to the database account used by the application, removing FILE, DROP, and ALTER privileges where not required.
Consider migrating to a maintained church management platform if vendor patches are not forthcoming.

bash

# Example WAF rule concept (ModSecurity)
SecRule ARGS:na "@detectSQLi" \
    "id:1002024,phase:2,deny,status:403,\
     msg:'CVE-2024-3538 SQLi attempt on addTithes.php',\
     tag:'application-multi',tag:'attack-sqli'"