CVE-2026-39343: ChurchCRM SQL Injection Vulnerability

CVE-2026-39343 Overview

CVE-2026-39343 is a SQL injection vulnerability discovered in ChurchCRM, an open-source church management system. The vulnerability exists in the EditEventTypes.php file, where the EN_tyid POST parameter is not properly sanitized before being used in a SQL query. This allows an authenticated administrator to execute arbitrary SQL commands directly against the underlying database, potentially leading to data exfiltration, modification, or deletion of sensitive church member information.

Critical Impact

Authenticated administrators can leverage this SQL injection flaw to execute arbitrary database commands, compromising the confidentiality, integrity, and availability of all data stored in the ChurchCRM database including sensitive member information.

Affected Products

• ChurchCRM versions prior to 7.1.0
• ChurchCRM EditEventTypes.php component
• ChurchCRM installations with administrative access

Discovery Timeline

• 2026-04-07 - CVE-2026-39343 published to NVD
• 2026-04-08 - Last updated in NVD database

Technical Details for CVE-2026-39343

Vulnerability Analysis

This SQL injection vulnerability (CWE-89) affects the EditEventTypes.php file in ChurchCRM's administrative interface. The flaw stems from improper input validation of the EN_tyid POST parameter, which is directly incorporated into SQL queries without adequate sanitization or parameterization. While the vulnerability requires administrative privileges to exploit, it still represents a significant security risk as it allows complete database manipulation capabilities beyond what the application interface normally permits.

The administrative context does not mitigate the severity of this vulnerability, as compromised administrator accounts, insider threats, or privilege escalation from other vulnerabilities could all lead to exploitation. An attacker with admin access could use this SQL injection to extract sensitive data, modify records, or potentially compromise the underlying database server.

Root Cause

The root cause of this vulnerability is the failure to implement proper input sanitization and parameterized queries in the EditEventTypes.php file. The EN_tyid POST parameter is concatenated directly into SQL statements rather than being passed through prepared statements or parameterized queries, which is a common secure coding practice to prevent SQL injection attacks.

Attack Vector

The attack is network-based and requires an authenticated session with administrative privileges. An attacker would need to:

1. Obtain valid administrator credentials for the ChurchCRM installation
2. Navigate to or directly access the EditEventTypes.php endpoint
3. Craft a malicious POST request with SQL injection payloads in the EN_tyid parameter
4. Execute arbitrary SQL commands against the database

The vulnerability can be exploited by injecting SQL syntax into the EN_tyid parameter. An attacker could append UNION-based queries to extract data from other tables, use boolean-based or time-based blind injection techniques, or execute database-specific commands depending on the backend database system in use. For detailed technical analysis, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-39343

Indicators of Compromise

• Unusual SQL query patterns in database logs containing the EN_tyid parameter
• HTTP POST requests to EditEventTypes.php with suspicious characters such as single quotes, semicolons, or SQL keywords
• Database errors or exceptions logged from the ChurchCRM application
• Unexpected data modifications or access patterns in the church member database

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect SQL injection patterns in POST requests to EditEventTypes.php
• Monitor database query logs for anomalous SQL statements originating from the ChurchCRM application
• Deploy application-level logging to capture and alert on malformed input in the EN_tyid parameter
• Use intrusion detection systems (IDS) with signatures for common SQL injection attack patterns

Monitoring Recommendations

• Enable detailed logging for all administrative actions within ChurchCRM
• Configure database audit logging to track all queries executed against member data tables
• Set up alerts for multiple failed or unusual requests to administrative endpoints
• Implement real-time monitoring of POST parameters for SQL injection indicators

How to Mitigate CVE-2026-39343

Immediate Actions Required

• Upgrade ChurchCRM to version 7.1.0 or later immediately
• Review database logs for any evidence of exploitation attempts
• Audit administrator accounts and ensure strong authentication controls are in place
• Consider temporarily restricting access to the EditEventTypes.php endpoint until patching is complete

Patch Information

ChurchCRM has addressed this vulnerability in version 7.1.0. Organizations running any version prior to 7.1.0 should upgrade immediately. The fix implements proper input sanitization and parameterized queries for the EN_tyid parameter. Detailed patch information is available in the GitHub Security Advisory.

Workarounds

• Implement a Web Application Firewall (WAF) with rules to block SQL injection patterns targeting the affected endpoint
• Restrict network access to the ChurchCRM administrative interface to trusted IP addresses only
• Enable database query logging and monitoring to detect potential exploitation attempts
• Review and limit the number of users with administrative privileges to reduce the attack surface

If immediate patching is not possible, administrators can implement additional input validation at the web server level:

# Example Apache mod_security rule to block SQL injection in EN_tyid
# Add to your Apache configuration or .htaccess file
SecRule ARGS:EN_tyid "@detectSQLi" \
    "id:1001,\
    phase:2,\
    deny,\
    status:403,\
    msg:'SQL Injection attempt detected in EN_tyid parameter',\
    log,\
    auditlog"