VYPR
← All advisories
High severity7.2NVD Advisory· Published Dec 1, 2025· Updated Jun 17, 2026

CVE-2025-66313

CVE-2025-66313

Description

ChurchCRM is an open-source church management system. In ChurchCRM 6.2.0 and earlier, there is a time-based blind SQL injection in the handling of the 1FieldSec parameter. Injecting SLEEP() causes deterministic server-side delays, proving the value is incorporated into a SQL query without proper parameterization. The issue allows data exfiltration and modification via blind techniques.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • Churchcrm/CRMv5
    Range: <= 6.2.0
  • Churchcrm/Churchcrmllm-fuzzy2 versions
    <=6.2.0+ 1 more
    • (no CPE)range: <=6.2.0
    • cpe:2.3:a:churchcrm:churchcrm:*:*:*:*:*:*:*:*range: <=6.2.0

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.