Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
ChurchCRM is an open-source church management system. Versions prior to 6.5.3 have a SQL injection vulnerability in the `src/CartToFamily.php` file, specifically in how the `PersonAddress` POST parameter is handled. Unlike other parameters in the same file which are correctly cast to integers using the `InputUtils` class, the `PersonAddress` parameter is missing the type definition. This allows an attacker to inject arbitrary SQL commands directly into the query. Version 6.5.3 fixes the issue.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-04-10 | 1 | General1 |
| 2026-04-20 | 1 | PoC1 |
Já viram meu artigo da minha primeira CVE? Logo logo posto as outras duas também. #bolhasec #bolhadev https://kilserv.vercel.app/research/churchcrm-sqli-cve-2025-67877
Post summary
The user shares a link to an article about his first CVE (likely a SQL injection), but offers no PoC, exploit code, patch, or evidence of active exploitation.
A vendor já aplicou os patches (CVE-2026-33288 e CVE-2026-33289). Pra quem curte code review e quer entender como a parada quebra por baixo dos panos, a PoC completinha no meu portfólio ou no medium: https://medium.com/@gui.mury.gm/from-code-analysis-to-cve-uncovering-sql-injection-in-churchcrm-cve-2025-67877-783c03863de9?postPublishedType=initial
Post summary
O texto anuncia que o fornecedor já aplicou patches para CVE-2026-33288 e CVE-2026-33289, e disponibiliza um PoC completo via Medium.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | churchcrm | churchcrm | - | - | - |