ChurchCRM is an open-source church management system. Prior to 7.1.0, the NewRole POST parameter in src/MemberRoleChange.php is used in an SQL query without pro…

ChurchCRM, an open-source church management system, contains a SQL injection vulnerability in versions prior to 7.1.0. The vulnerability exists in the NewRole POST parameter in src/MemberRoleChange.php where user input is used in SQL queries without proper integer validation. Authenticated users with ManageGroups role can exploit this to inject arbitrary SQL code. The attack requires knowledge of valid GroupID and PersonID values which can be obtained from GroupView or PersonView pages. The vulnerability has been patched in version 7.1.0.