CVE-2025-1023

critical · 9.3

A public exploit / detection template exists

Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →

A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to execute arbitrary SQL queries by exploiting a time-based blind SQL Injection vulnerability in the EditEventTypes functionality. The newCountName parameter is directly concatenated into an SQL query without proper sanitization, allowing an attacker to manipulate database queries and execute arbitrary commands, potentially leading to data exfiltration, modification, or deletion.

9.3

CVSS

2.5%

EPSS (exploit prob.)

84th

EPSS percentile

2025-02-18

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:H/U:Red

Weaknesses

CWE-89

Affected products

Vendor	Product	Affected versions
churchcrm	churchcrm	<= 5.13.0

Check a specific version with /api/v1/cve/match.

References

https://github.com/ChurchCRM/CRM/issues/7246

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-1023