CVE-2026-39318

{
  "id": "CVE-2026-39318",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-07T18:16:42.810",
  "lastModified": "2026-10-26T22:10:00.163",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "ChurchCRM is an open-source church management system. Versions prior to 7.1.0 have an SQL injection vulnerability in the endpoints `/GroupPropsFormRowOps.php`, `/PersonCustomFieldsRowOps.php`, and `/FamilyCustomFieldsRowOps.php`. A user has to be authenticated. For `ManageGroups` privileges have to be enabled and for the other two endpoints the attack has to be executed by an administrative user. These users can inject arbitrary SQL statements through the `Field` parameter and thus modify tables from the database.  This vulnerability is fixed in 7.1.0."
    },
    {
      "lang": "es",
      "value": "ChurchCRM es un sistema de gestión de iglesias de código abierto. Antes de 7.1.0, el archivo GroupPropsFormRowOps.php contiene una vulnerabilidad de inyección SQL. La entrada del usuario en el parámetro Field se inserta directamente en consultas SQL sin una sanitización adecuada. La función mysqli_real_escape_string() no escapa los caracteres de acento grave, lo que permite a los atacantes salir del contexto de identificador SQL y ejecutar sentencias SQL arbitrarias. Esta vulnerabilidad está corregida en 7.1.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "ChurchCRM",
          "product": "CRM",
          "versions": [
            {
              "version": "< 7.1.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-08T18:46:28.790516Z",
          "id": "CVE-2026-39318",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:churchcrm:churchcrm:*:*:*:*:*:*:*:*",
              "versionEndIncluding": "7.0.5",
              "matchCriteriaId": "7DD42DAF-385C-4BEB-B5B9-50838CEA9D2E"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/ChurchCRM/CRM/security/advisories/GHSA-8r53-w4r6-w62c",
      "source": "[email protected]",
      "tags": [
        "Not Applicable"
      ]
    },
    {
      "url": "https://github.com/ChurchCRM/CRM/security/advisories/GHSA-j3vj-59vv-h4rc",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://github.com/ChurchCRM/CRM/security/advisories/GHSA-j3vj-59vv-h4rc",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ]
    }
  ]
}