CVE-2026-39319 - Vulnerability Analysis

Overview

ChurchCRM < 7.1.0 contains a second order SQL injection caused by improper sanitization of the iCurrentFundraiser PHP session parameter in /FundRaiserEditor.php, letting authenticated users inject arbitrary SQL to extract and modify database information, exploit requires user authentication.

Severity & Score

Impact

Authenticated users can extract and modify database information, potentially compromising data integrity and confidentiality.

Mitigation

Upgrade to version 7.1.0 or later.

References

• https://github.com/ChurchCRM/CRM/security/advisories/GHSA-vg4m-hc29-jgqj

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner