CVE-2026-24854: ChurchCRM SQL Injection Vulnerability

CVE-2026-24854 Overview

CVE-2026-24854 is a SQL Injection vulnerability in ChurchCRM, an open-source church management system. The vulnerability exists in the /PaddleNumEditor.php endpoint, where the PerID parameter is not properly sanitized before being used in SQL queries. Any authenticated user, including those with zero assigned permissions, can exploit this flaw to execute arbitrary SQL commands against the underlying database.

Critical Impact

Authenticated attackers can leverage this SQL injection to read, modify, or delete sensitive church member data, potentially compromising the entire database containing personal information, financial records, and confidential communications.

Affected Products

• ChurchCRM versions prior to 6.7.2
• All ChurchCRM installations with authenticated user access
• Deployments using the vulnerable PaddleNumEditor.php endpoint

Discovery Timeline

• 2026-01-30 - CVE CVE-2026-24854 published to NVD
• 2026-02-04 - Last updated in NVD database

Technical Details for CVE-2026-24854

Vulnerability Analysis

This SQL Injection vulnerability (CWE-89) stems from insufficient input validation in the PaddleNumEditor.php file. The application accepts user-controlled input through the PerID POST parameter and incorporates it directly into SQL queries without proper sanitization or parameterization. This allows attackers to manipulate the SQL query structure by injecting malicious SQL code through the vulnerable parameter.

The vulnerability is particularly concerning because it requires only basic authentication to exploit—even users with no assigned permissions within the ChurchCRM system can leverage this attack vector. This means any compromised or malicious account holder can potentially access the entire database, exfiltrate sensitive congregational data, or cause significant data integrity issues.

Root Cause

The root cause is the use of InputUtils::legacyFilterInput() without explicit type casting for integer parameters. The PerID and related parameters were being passed through legacy filtering that did not adequately prevent SQL injection payloads. The vulnerable code directly concatenated user input into SQL query strings, a classic pattern that enables SQL injection attacks.

Attack Vector

An authenticated attacker can send a crafted HTTP POST request to the /PaddleNumEditor.php endpoint with a malicious payload in the PerID parameter. Since the parameter is used in multiple SQL queries (SELECT, UPDATE, INSERT, DELETE statements), the attacker has multiple injection points to exploit. The network-accessible nature of this vulnerability allows remote exploitation from any authenticated session.

// Vulnerable code pattern (before patch)
// The PerID parameter was passed to legacyFilterInput without integer casting
$iPerID = InputUtils::legacyFilterInput($_POST['PerID']);

// This allowed SQL injection when PerID was used in queries like:
$sqlNumBought = 'SELECT mb_count from multibuy_mb WHERE mb_per_ID=' . $iPerID . ' AND mb_item_ID=' . $di_ID;

// Patched code casts to integer, preventing injection:
$iPerID = (int) InputUtils::legacyFilterInput($_POST['PerID']);

Source: GitHub Commit Details

Detection Methods for CVE-2026-24854

Indicators of Compromise

• Unusual or malformed requests to /PaddleNumEditor.php containing SQL syntax characters (single quotes, semicolons, UNION keywords)
• Database error messages in application logs related to the multibuy_mb table or invalid SQL syntax
• Unexpected database queries or access patterns from the ChurchCRM application user account
• Evidence of data exfiltration or unauthorized data access in database audit logs

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns in POST requests to PaddleNumEditor.php
• Monitor web server access logs for suspicious requests containing SQL metacharacters in the PerID parameter
• Enable database query logging and alert on anomalous query patterns or syntax errors
• Deploy application-layer intrusion detection to identify SQL injection attack signatures

Monitoring Recommendations

• Enable detailed logging for all requests to the /PaddleNumEditor.php endpoint
• Configure database audit logging to track queries against the multibuy_mb table
• Set up alerting for authentication anomalies where low-privilege users access administrative endpoints
• Monitor for unusual data access patterns that may indicate post-exploitation data exfiltration

How to Mitigate CVE-2026-24854

Immediate Actions Required

• Upgrade ChurchCRM to version 6.7.2 or later immediately
• Review database audit logs for evidence of exploitation prior to patching
• Audit all user accounts and remove unnecessary access privileges
• Consider temporarily restricting access to the PaddleNumEditor.php endpoint until patching is complete

Patch Information

ChurchCRM has released version 6.7.2 which addresses this vulnerability. The patch implements explicit integer type casting on the PerID, Num, MBCount, and di_ID parameters before they are used in SQL queries. This prevents SQL injection by ensuring only integer values are passed to the database queries.

The security fix can be reviewed in the GitHub Commit Details (commit 748f5084fc06c5e12463dc7fdd62d1d31fc08d38). Additional information is available in the GitHub Security Advisory GHSA-p3q7-q68q-h2gr.

Workarounds

• If immediate patching is not possible, restrict network access to the ChurchCRM application to trusted IP addresses only
• Implement a Web Application Firewall with SQL injection protection rules targeting the vulnerable endpoint
• Disable or restrict access to the PaddleNumEditor.php functionality until the patch can be applied
• Review and minimize the number of authenticated user accounts with access to the system

# Example: Restrict access to vulnerable endpoint via Apache .htaccess
# Place in ChurchCRM web root directory
<Files "PaddleNumEditor.php">
    Order deny,allow
    Deny from all
    # Allow only from trusted admin IP addresses
    Allow from 192.168.1.0/24
    Allow from 10.0.0.0/8
</Files>