CVE-2025-66313

ChurchCRM is an open-source church management system. In ChurchCRM 6.2.0 and earlier, there is a time-based blind SQL injection in the handling of the 1FieldSec parameter. Injecting SLEEP() causes deterministic server-side delays, proving the value is incorporated into a SQL query without proper parameterization. The issue allows data exfiltration and modification via blind techniques.

• CWE-89

• https://github.com/ChurchCRM/CRM/commit/719a6bc73245c40e3c30dae6229daaecd451e59fPatch
• https://github.com/ChurchCRM/CRM/security/advisories/GHSA-47q3-c874-mqvpExploit, Vendor Advisory
• https://github.com/ChurchCRM/CRM/security/advisories/GHSA-47q3-c874-mqvpExploit, Vendor Advisory

Published

Dec 1, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-66308This admin plugin for Grav is an HTML user interface that pr…5.4
• CVE-2025-66309This admin plugin for Grav is an HTML user interface that pr…6.1
• CVE-2025-6631A maliciously crafted PRT file, when parsed through certain …7.8
• CVE-2025-66310This admin plugin for Grav is an HTML user interface that pr…5.4
• CVE-2025-66311This admin plugin for Grav is an HTML user interface that pr…5.4
• CVE-2025-66312This admin plugin for Grav is an HTML user interface that pr…5.4
• CVE-2025-66314Improper Privilege Management vulnerability in ZTE ElasticNe…7.5
• CVE-2025-66315There is a configuration defect vulnerability in the version…8.8
• CVE-2025-66319Permission control vulnerability in the resource scheduling …5.5
• CVE-2025-6632A maliciously crafted PSD file, when linked or imported into…7.8
• CVE-2025-66320Multi-thread race condition vulnerability in the camera fram…4.7
• CVE-2025-66321Multi-thread race condition vulnerability in the camera fram…4.7