ChurchCRM is an open-source church management system. Prior to 7.1.0, an SQL injection vulnerability was found in the endpoint /SettingsIndividual.php in Church…

ChurchCRM, an open-source church management system, contains an SQL injection vulnerability in version 7.0.5 prior to 7.1.0. The vulnerability exists in the /SettingsIndividual.php endpoint where authenticated users without specific privileges can inject arbitrary SQL statements through the type array parameter via the index. This allows attackers to extract and modify database information. The vulnerability has been fixed in version 7.1.0.