2 lines
4.2 KiB
JSON
2 lines
4.2 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"ChurchCRM","vendor":"ChurchCRM","versions":[{"status":"affected","version":"ChurchCRM 5.13.0 and prior"}]}],"source":"b7efe717-a805-47cf-8e9a-921fca0ce0ce"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:churchcrm:churchcrm:*:*:*:*:*:*:*:*","matchCriteriaId":"552A51B0-B2AE-4A12-BF43-DDCE1D8A29D2","versionEndIncluding":"5.13.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to execute arbitrary SQL queries by exploiting a time-based blind SQL Injection vulnerability in the EditEventTypes functionality. The newCountName parameter is directly concatenated into an SQL query without proper sanitization, allowing an attacker to manipulate database queries and execute arbitrary commands, potentially leading to data exfiltration, modification, or deletion."},{"lang":"es","value":"Existe una vulnerabilidad en ChurchCRM 5.13.0 y anterior que permite a un atacante ejecutar consultas SQL arbitrarias al explotar una vulnerabilidad de inyección Blind SQL en la funcionalidad EditEventTypes. El parámetro newCountName se concatena directamente en una consulta SQL sin una depuración adecuada, lo que permite a un atacante manipular consultas de base de datos y ejecutar comandos arbitrarios, lo que potencialmente conduce a la exfiltración, modificación o eliminación de datos."}],"id":"CVE-2025-1023","lastModified":"2026-06-17T08:38:15.037","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"YES","Recovery":"USER","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"RED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"CONCENTRATED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:H/U:Red","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"HIGH"},"source":"b7efe717-a805-47cf-8e9a-921fca0ce0ce","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-1023","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2025-02-18T14:27:14.150090Z","version":"2.0.3"}}]},"published":"2025-02-18T10:15:10.500","references":[{"source":"b7efe717-a805-47cf-8e9a-921fca0ce0ce","tags":["Exploit","Issue Tracking","Third Party Advisory"],"url":"https://github.com/ChurchCRM/CRM/issues/7246"}],"sourceIdentifier":"b7efe717-a805-47cf-8e9a-921fca0ce0ce","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"b7efe717-a805-47cf-8e9a-921fca0ce0ce","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-89"}],"source":"nvd@nist.gov","type":"Primary"}]}
|