Description
ChurchCRM is an open-source church management system. Versions prior to 6.5.3 have a SQL injection vulnerability in the `src/CartToFamily.php` file, specifically in how the `PersonAddress` POST parameter is handled. Unlike other parameters in the same file which are correctly cast to integers using the `InputUtils` class, the `PersonAddress` parameter is missing the type definition. This allows an attacker to inject arbitrary SQL commands directly into the query. Version 6.5.3 fixes the issue.
INFO
Published Date :
2025-12-17T21:25:18.465Z
Last Modified :
2025-12-18T15:08:47.266Z
Source :
GitHub_M
AFFECTED PRODUCTS
The following products are affected by CVE-2025-67877 vulnerability.
| Vendors | Products |
|---|---|
| Churchcrm |
|
REFERENCES
Here, you will find a curated list of external links that provide in-depth information to CVE-2025-67877.
CVSS Vulnerability Scoring System
Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Attack Requirements
Privileges Required
User Interaction
VS Confidentiality
VS Integrity
VS Availability
SS Confidentiality
SS Integrity
SS Availability