CVE-2023-25348

HIGH

ChurchCRM 4.5.3 - CSV Injection via Last Name and First Name Input Fields

Title source: llm

Description

ChurchCRM 4.5.3 was discovered to contain a CSV injection vulnerability via the Last Name and First Name input fields when creating a new person. These vulnerabilities allow attackers to execute arbitrary code via a crafted excel file.

References (2)

Core 2

Core References

Exploit, Third Party Advisory

https://github.com/10splayaSec/CVE-Disclosures/tree/main/ChurchCRM/CVE-2023-25348

View Exploit ZIP pw:eip

Product

https://github.com/ChurchCRM/CRM

Scores

CVSS v3 7.8

EPSS 0.0044

EPSS Percentile 34.6%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact total

Details

CWE

CWE-1236

Status published

Products (1)

churchcrm/churchcrm 4.5.3

Published Apr 25, 2023

Tracked Since Feb 18, 2026