CVE-2026-39342: ChurchCRM SQL Injection Vulnerability

CVE-2026-39342 Overview

ChurchCRM is an open-source church management system used by religious organizations to manage members, donations, and events. CVE-2026-39342 is a SQL injection vulnerability [CWE-89] affecting ChurchCRM versions prior to 7.1.0. The flaw resides in the searchwhat parameter handled by QueryView.php when invoked with QueryID=15 (the Advanced Search query). An authenticated user with access to Data/Reports > Query Menu can inject arbitrary SQL statements. The vulnerability is fixed in ChurchCRM 7.1.0.

Critical Impact
Authenticated attackers can read, modify, or destroy database contents — including member records, financial data, and credentials — through SQL injection in the Advanced Search query.

Affected Products

ChurchCRM versions prior to 7.1.0
QueryView.php endpoint with QueryID=15 (Advanced Search)
Deployments exposing the Query Menu to authenticated users

Discovery Timeline

2026-04-07 - CVE-2026-39342 published to NVD
2026-04-10 - Last updated in NVD database

Technical Details for CVE-2026-39342

Vulnerability Analysis

The vulnerability is a classic SQL injection [CWE-89] in the Advanced Search functionality of ChurchCRM. When a user submits a query through QueryView.php with QueryID=15, the application passes the searchwhat parameter into a SQL statement without sufficient sanitization or parameterization. An authenticated user with access to the Query Menu and the Advanced Search query can supply crafted input that breaks out of the intended query context. The injected SQL executes with the privileges of the ChurchCRM database user, granting access to the entire application database.

Root Cause

The root cause is improper neutralization of user-supplied input in a SQL query. The searchwhat parameter is concatenated into the dynamic SQL constructed by the Advanced Search handler rather than being bound as a parameter. Because the value is treated as part of the query syntax, attackers can append clauses such as UNION SELECT, modify WHERE conditions, or terminate the original statement and stack additional commands depending on driver configuration.

Attack Vector

Exploitation requires network access to the ChurchCRM web interface and an authenticated account with permission to the Data/Reports > Query Menu and the Advanced Search query. The attacker issues an HTTP request to QueryView.php with QueryID=15 and a malicious searchwhat value. No user interaction beyond the attacker's own session is required. Because many ChurchCRM deployments grant report access to broad user roles, the privilege barrier is often low in practice.

No public proof-of-concept exploit has been published. Technical details are described in the GitHub Security Advisory GHSA-7fr4-mvfm-cxfx.

Detection Methods for CVE-2026-39342

Indicators of Compromise

HTTP requests to QueryView.php containing QueryID=15 and SQL meta-characters (', --, UNION, SELECT, ;) in the searchwhat parameter
Web server access logs showing unusually long or encoded searchwhat values from authenticated sessions
Unexpected database errors or large result sets logged by the ChurchCRM application
Outbound traffic or data exfiltration originating from the ChurchCRM database host

Detection Strategies

Inspect web access logs for GET or POST requests to QueryView.php?QueryID=15 and flag non-alphanumeric content in searchwhat
Deploy a web application firewall rule targeting SQL injection patterns on the ChurchCRM URI path
Enable MySQL or MariaDB general query logging temporarily to identify malformed queries originating from the application
Correlate authentication events with Advanced Search activity to spot abuse by compromised accounts

Monitoring Recommendations

Monitor for new or modified database users, privilege grants, and schema changes within the ChurchCRM database
Alert on bulk reads from sensitive tables such as person_per, family_fam, and credential or donation tables
Track failed login attempts followed by successful logins targeting accounts with report access
Review audit logs for the Query Menu and Advanced Search usage at least weekly

How to Mitigate CVE-2026-39342

Immediate Actions Required

Upgrade ChurchCRM to version 7.1.0 or later without delay
Restrict access to Data/Reports > Query Menu to a minimal set of trusted administrators until patching is complete
Rotate database credentials and any application secrets that may have been exposed if exploitation is suspected
Review user accounts and revoke unnecessary report or query permissions

Patch Information

The vulnerability is fixed in ChurchCRM 7.1.0. Upgrade instructions and the security advisory are available at the ChurchCRM GitHub Security Advisory GHSA-7fr4-mvfm-cxfx. Administrators should back up the database before applying the upgrade and verify that the QueryView.php handler reflects the patched code.

Workarounds

Disable or remove the Advanced Search query (QueryID=15) from the Query Menu until the upgrade is applied
Place the ChurchCRM instance behind a web application firewall with SQL injection signatures enabled
Limit the ChurchCRM database account to least-privilege permissions, removing FILE, DROP, and administrative rights
Restrict network access to the ChurchCRM administrative interface to trusted source addresses

bash

# Example: restrict database privileges for the ChurchCRM user
REVOKE ALL PRIVILEGES ON churchcrm.* FROM 'churchcrm_user'@'localhost';
GRANT SELECT, INSERT, UPDATE, DELETE ON churchcrm.* TO 'churchcrm_user'@'localhost';
FLUSH PRIVILEGES;