Description
ChurchCRM存在SQL注入漏洞。此漏洞是由于GetText.php对用户发送的请求缺乏校验导致的。
ChurchCRM GetText.php SQL注入漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://grimthereaperteam.medium.com/churchcrm-4-4-5-sql-injection-at-gettext-php-64cecdaacce6
https://github.com/ChurchCRM/CRM/security/advisories/GHSA-r2gf-5m64-8v39
http://software.sonicwall.com/applications/ips/index.asp?ev=sig&sigid=20426
https://www.sentinelone.com/vulnerability-database/cve-2026-39330/
https://vuldb.com/vuln/220539
https://vulmon.com/searchpage?q=churchcrm
https://nvd.nist.gov/vuln/detail/CVE-2023-24684
https://www.cve.org/CVERecord?id=CVE-2023-24684
https://access.redhat.com/security/cve/cve-2023-24684
https://zone.huoxian.cn/d/2866-day-churchcrm-cms-sql