CVE-2024-3539: Church Management System SQLi Vulnerability

CVE-2024-3539 Overview

CVE-2024-3539 is a SQL injection vulnerability in Campcodes Church Management System 1.0. The flaw resides in the /admin/addgiving.php script, where the amount parameter is passed to a database query without proper sanitization. Authenticated attackers can inject arbitrary SQL statements over the network to read, modify, or delete backend database contents. The vulnerability is tracked in VulDB as identifier VDB-259909 and has been publicly disclosed. Public disclosure of the exploit method increases the likelihood of opportunistic scanning against exposed installations.

Critical Impact
Remote SQL injection through the amount parameter allows attackers with low-privilege accounts to compromise database confidentiality, integrity, and availability.

Affected Products

Campcodes Church Management System 1.0
/admin/addgiving.php administrative endpoint
Deployments exposing the admin panel to untrusted networks

Discovery Timeline

2024-04-10 - CVE-2024-3539 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-3539

Vulnerability Analysis

The vulnerability is a SQL injection flaw classified under CWE-89. The addgiving.php script accepts a POST or GET parameter named amount and concatenates the value directly into a SQL statement. No parameterized queries, prepared statements, or input validation are applied before the value reaches the database driver.

An authenticated user with access to the administrative giving module can supply crafted input containing SQL syntax. The database engine parses the injected fragment as part of the query, giving the attacker control over the executed statement. Successful exploitation can expose stored donation records, member data, and authentication material. Attackers can also modify records or drop tables, undermining the integrity and availability of the application.

Root Cause

The root cause is missing input sanitization on the amount field before it is embedded in a SQL query. The application trusts client-supplied data and constructs queries through string concatenation. This anti-pattern makes every user-controlled input a potential injection vector.

Attack Vector

The attack is network-based and requires low-privileged authentication to reach the administrative endpoint. An attacker submits a request to /admin/addgiving.php with a malicious amount value. The injected SQL executes with the privileges of the application database user, which typically has full read and write access to the application schema. Public disclosure of the exploit lowers the technical barrier for reuse.

Because no verified proof-of-concept code has been published in the referenced advisories, technical details are limited to the parameter and endpoint identified in the GitHub Vulnerability Report and VulDB Entry #259909.

Detection Methods for CVE-2024-3539

Indicators of Compromise

HTTP requests to /admin/addgiving.php containing SQL metacharacters such as single quotes, UNION, SELECT, SLEEP, or comment sequences (--, #) in the amount parameter
Web server or application logs showing database errors originating from the giving module
Unexpected new administrative accounts or modified donation records in the application database
Outbound connections from the web server to unfamiliar destinations after suspicious requests

Detection Strategies

Deploy web application firewall rules that inspect the amount parameter for SQL syntax and non-numeric content
Enable database query logging and alert on syntactically anomalous queries originating from the church management application
Correlate authenticated session activity with request payloads to identify low-privilege accounts issuing injection attempts

Monitoring Recommendations

Review access logs for /admin/addgiving.php and flag requests where amount is not a numeric value
Monitor for repeated 500-level responses from the giving endpoint, which often accompany blind SQL injection probing
Track database user activity for INFORMATION_SCHEMA reads and unexpected UNION operations

How to Mitigate CVE-2024-3539

Immediate Actions Required

Restrict access to /admin/ paths using network controls, VPN, or IP allowlisting until a patched version is available
Audit administrative accounts and rotate credentials for the application database user
Enforce numeric-only server-side validation on the amount parameter through a reverse proxy or WAF rule

Patch Information

No vendor patch or fixed version has been referenced in the advisories at the time of publication. Campcodes has not issued a security update for Church Management System 1.0 in the sources listed. Organizations should consult the VulDB CTI entry for updates and consider migrating away from the unmaintained release.

Workarounds

Place the application behind a WAF configured to block SQL injection payloads targeting the amount field
Reduce the database user's privileges to the minimum required for application operation, removing DROP, ALTER, and cross-schema access
Disable or remove the giving module if it is not in active use
Wrap the vulnerable endpoint with server-side input validation that rejects any non-decimal value before it reaches the query