CVE-2024-3540: Church Management System SQL Injection

CVE-2024-3540 Overview

CVE-2024-3540 is a SQL injection vulnerability in Campcodes Church Management System 1.0. The flaw exists in the /admin/add_sundaysch.php script, where the Gender parameter is passed directly into a database query without sanitization. Authenticated attackers can inject arbitrary SQL statements over the network to read, modify, or delete database contents. The exploit has been publicly disclosed under VulDB identifier 259910, increasing the likelihood of opportunistic exploitation against exposed instances. The vulnerability is classified under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Authenticated remote attackers can execute arbitrary SQL commands against the backend database, leading to full compromise of confidentiality, integrity, and availability of church member data.

Affected Products

Campcodes Church Management System 1.0
Deployments using the /admin/add_sundaysch.php endpoint
Web applications built on the same vulnerable codebase

Discovery Timeline

2024-04-10 - CVE-2024-3540 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-3540

Vulnerability Analysis

The vulnerability resides in the Sunday school registration workflow of Campcodes Church Management System 1.0. The /admin/add_sundaysch.php script accepts the Gender parameter from an HTTP request and concatenates it directly into a SQL statement. No parameterized queries, prepared statements, or input filtering are applied before the value reaches the database driver.

An attacker with low-privilege administrative session access can supply crafted SQL syntax in the Gender field. The database executes the injected payload with the same privileges as the application account. Successful exploitation exposes stored member records, credentials, and administrative data.

The attack requires network access and low privileges, but no user interaction. The impact spans confidentiality, integrity, and availability, since attackers can SELECT, UPDATE, DELETE, or use stacked queries depending on the database engine.

Root Cause

The root cause is improper neutralization of special elements in a SQL command [CWE-89]. The Gender parameter is trusted as safe input and concatenated into the query string without validation, escaping, or the use of prepared statements.

Attack Vector

An attacker sends a crafted POST request to /admin/add_sundaysch.php containing SQL syntax within the Gender parameter. Because the application already exposes this endpoint over the network and requires only a low-privilege authenticated session, exploitation is straightforward. Public proof-of-concept material referenced in the GitHub Vulnerability Document documents the injection points.

The vulnerability manifests when unsanitized input reaches the SQL query builder. See the referenced VulDB Entry #259910 for additional technical detail and the disclosed proof of concept.

Detection Methods for CVE-2024-3540

Indicators of Compromise

HTTP POST requests to /admin/add_sundaysch.php containing SQL metacharacters such as single quotes, UNION, SLEEP, or comment sequences (--, #) in the Gender field.
Unexpected database errors or long response times originating from the Sunday school registration endpoint.
New administrative accounts, altered member records, or unexplained data exports from the Church Management System database.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the Gender parameter for SQL injection payloads and block anomalous syntax.
Enable verbose database query logging and alert on queries that contain tautologies, UNION SELECT, or unusual INFORMATION_SCHEMA access originating from the CMS service account.
Correlate authentication logs with request patterns to identify low-privilege admin sessions issuing repeated malformed POSTs to /admin/add_sundaysch.php.

Monitoring Recommendations

Forward web server, PHP, and database logs to a centralized log platform and alert on injection signatures targeting the affected endpoint.
Monitor for outbound data volume spikes from the database host that could indicate mass record extraction.
Track integrity of critical tables such as users, members, and administrative role tables through periodic checksums.

How to Mitigate CVE-2024-3540

Immediate Actions Required

Restrict access to /admin/ paths using network ACLs, VPN, or IP allowlisting until a fix is in place.
Rotate all administrative credentials for the Church Management System and audit existing accounts for unauthorized additions.
Deploy a WAF rule to block SQL metacharacters in the Gender parameter of add_sundaysch.php requests.

Patch Information

No official vendor patch is listed in the referenced advisories at the time of publication. Organizations running Campcodes Church Management System 1.0 should monitor the vendor and the VulDB CTI record for updates. Where possible, migrate to a maintained alternative or apply source-level fixes to replace concatenated SQL with prepared statements using parameter binding.

Workarounds

Modify add_sundaysch.php to validate Gender against an allowlist of expected values such as Male or Female before use in any SQL query.
Refactor database calls to use PDO or MySQLi prepared statements with bound parameters, eliminating direct string concatenation.
Run the application database account with the least privileges required, denying DROP, ALTER, and FILE permissions to limit blast radius.

bash

# Example WAF rule (ModSecurity) blocking SQLi patterns in the Gender parameter
SecRule ARGS:Gender "@rx (?i)(union(.*?)select|sleep\(|--|#|';|\bor\b\s+\d+=\d+)" \
    "id:1004824,phase:2,deny,status:403,log,msg:'CVE-2024-3540 SQLi attempt on add_sundaysch.php'"