CVE-2026-39330: ChurchCRM SQL Injection Vulnerability

CVE-2026-39330 Overview

CVE-2026-39330 is a SQL Injection vulnerability discovered in ChurchCRM, an open-source church management system. The vulnerability exists in the /PropertyAssign.php endpoint, where authenticated users with the role Manage Groups & Roles (ManageGroups) and Edit Records (isEditRecordsEnabled) can inject arbitrary SQL statements through the Value parameter. Successful exploitation allows attackers to extract and modify information from the database, potentially compromising sensitive church member data and system integrity.

Critical Impact
Authenticated attackers can extract, modify, or delete sensitive data from the ChurchCRM database through SQL injection, potentially exposing personal information of church members and compromising system integrity.

Affected Products

ChurchCRM versions prior to 7.1.0
ChurchCRM installations with /PropertyAssign.php endpoint accessible

Discovery Timeline

2026-04-07 - CVE-2026-39330 published to NVD
2026-04-08 - Last updated in NVD database

Technical Details for CVE-2026-39330

Vulnerability Analysis

This SQL Injection vulnerability (CWE-89) affects the /PropertyAssign.php endpoint in ChurchCRM. The vulnerability requires authentication with specific roles, making it an authenticated attack vector. Users must possess both the ManageGroups role and have isEditRecordsEnabled permissions to exploit this flaw.

The attack is network-accessible and requires no user interaction, making it exploitable by any authenticated user with the appropriate privileges. Once exploited, an attacker gains the ability to read confidential data from the database, modify existing records, and potentially impact database availability depending on the injected queries.

Root Cause

The root cause of this vulnerability is improper input validation and sanitization of the Value parameter in the /PropertyAssign.php endpoint. User-supplied input is directly incorporated into SQL queries without adequate parameterization or escaping, allowing attackers to manipulate query logic through specially crafted input.

Attack Vector

The attack is conducted over the network against authenticated sessions. An attacker with the required roles (ManageGroups and isEditRecordsEnabled) can craft malicious HTTP requests to the /PropertyAssign.php endpoint, injecting SQL code through the Value parameter. This enables extraction of sensitive data through UNION-based or time-based blind SQL injection techniques, as well as modification of database records.

The vulnerability allows arbitrary SQL statement execution, meaning attackers can potentially:

Extract sensitive member information (names, addresses, financial contributions)
Modify or delete database records
Escalate privileges by manipulating user role tables
Potentially gain further system access depending on database configuration

For detailed technical information, see the GitHub Security Advisory.

Detection Methods for CVE-2026-39330

Indicators of Compromise

Unusual or malformed requests to /PropertyAssign.php containing SQL syntax in the Value parameter
Database query logs showing unexpected UNION, SELECT, or other SQL keywords in property assignment operations
Unexpected changes to database records without corresponding legitimate user actions
Error messages in application logs indicating SQL syntax errors or injection attempts

Detection Strategies

Implement Web Application Firewall (WAF) rules to detect SQL injection patterns in requests to /PropertyAssign.php
Monitor access logs for repeated requests to the vulnerable endpoint with varying Value parameters
Deploy database activity monitoring to detect anomalous query patterns or unauthorized data access
Review authentication logs for accounts with ManageGroups and isEditRecordsEnabled roles accessing the vulnerable endpoint

Monitoring Recommendations

Enable detailed logging for the /PropertyAssign.php endpoint and database queries
Configure alerts for SQL error messages or injection signatures in application logs
Monitor for bulk data extraction patterns that may indicate database exfiltration
Audit user accounts with ManageGroups and isEditRecordsEnabled permissions for unauthorized access

How to Mitigate CVE-2026-39330

Immediate Actions Required

Upgrade ChurchCRM to version 7.1.0 or later immediately
Review access logs for any suspicious activity targeting /PropertyAssign.php
Audit user accounts with ManageGroups and isEditRecordsEnabled roles
Consider temporarily restricting access to the vulnerable endpoint until patching is complete

Patch Information

The vulnerability has been fixed in ChurchCRM version 7.1.0. Organizations running versions prior to 7.1.0 should upgrade immediately. The patch addresses the SQL injection by implementing proper input validation and parameterized queries for the Value parameter in /PropertyAssign.php.

For patch details, refer to the GitHub Security Advisory.

Workarounds

Restrict network access to the ChurchCRM application to trusted IP ranges only
Temporarily disable or revoke ManageGroups and isEditRecordsEnabled roles from non-essential users until the patch is applied
Implement a WAF rule to block requests containing SQL injection patterns targeting /PropertyAssign.php
Place the ChurchCRM installation behind a reverse proxy with additional input validation

bash

# Example: Apache .htaccess rule to restrict access to vulnerable endpoint
<Files "PropertyAssign.php">
    Order Deny,Allow
    Deny from all
    Allow from 192.168.1.0/24
</Files>