ChurchCRM is an open-source church management system. Prior to 7.1.0, a critical SQL injection vulnerability exists in ChurchCRM's PropertyTypeEditor.php where …

A critical SQL injection vulnerability exists in ChurchCRM's PropertyTypeEditor.php file prior to version 7.1.0. The vulnerability allows authenticated users with 'Manage Properties' permission to execute arbitrary SQL commands through unsanitized Name and Description POST parameters. Attackers can perform data exfiltration, modification, and deletion operations. The injected data persists in the database and is reflected across multiple application pages without proper output encoding. This vulnerability affects the open-source church management system and has been fixed in version 7.1.0.