CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 2CVE-2022-31325 – ChurchCRM 4.4.5 - SQLi
https://notcve.org/view.php?id=CVE-2022-31325
There is a SQL Injection vulnerability in ChurchCRM 4.4.5 via the 'PersonID' field in /churchcrm/WhyCameEditor.php. Se presenta una vulnerabilidad de inyección SQL en ChurchCRM versión 4.4.5, por medio del campo "PersonID" en el archivo /churchcrm/WhyCameEditor.php ChurchCRM version 4.4.5 suffers from a remote SQL injection vulnerability. • https://www.exploit-db.com/exploits/50965 http://packetstormsecurity.com/files/167483/ChurchCRM-4.4.5-SQL-Injection.html https://github.com/ChurchCRM/CRM/issues/6005 https://github.com/nu11secur1ty/CVE-mitre/tree/main/2022/CVE-2022-31325 https://www.nu11secur1ty.com/2022/06/cve-2022-31325.htm • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2021-41965
https://notcve.org/view.php?id=CVE-2021-41965
A SQL injection vulnerability exists in ChurchCRM version 2.0.0 to 4.4.5 that allows an authenticated attacker to issue an arbitrary SQL command to the database through the unsanitized EN_tyid, theID and EID fields used when an Edit action on an existing record is being performed. Se presenta una vulnerabilidad de inyección SQL en ChurchCRM versiones 2.0.0 a 4.4.5, que permite a un atacante autenticado emitir un comando SQL arbitrario a la base de datos mediante los campos EN_tyid, theID y EID no saneados usados cuando es llevado a cabo una acción de edición en un registro existente • https://churchcrm.io https://www.alexbilz.com/post/2022-05-14-cve-2021-41965 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •