CVE-2024-39304
HIGHChurchCRM < 5.9.2 - Authenticated SQL Injection via EID Parameter in GetText.php
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2024-39304. PoCs published by Sanan Qasimzada, apena-ba.
AI-analyzed exploit summary This exploit demonstrates SQL injection in ChurchCRM 5.9.1 via the 'EID' parameter, allowing boolean-based blind, time-based blind, and UNION query attacks without authentication.
Description
ChurchCRM is an open-source church management system. Versions of the application prior to 5.9.2 are vulnerable to an authenticated SQL injection due to an improper sanitization of user input. Authentication is required, but no elevated privileges are necessary. This allows attackers to inject SQL statements directly into the database query due to inadequate sanitization of the EID parameter in in a GET request to `/GetText.php`. Version 5.9.2 patches the issue.
Exploits (2)
This exploit demonstrates SQL injection in ChurchCRM 5.9.1 via the 'EID' parameter, allowing boolean-based blind, time-based blind, and UNION query attacks without authentication.
This repository contains a functional Python exploit for CVE-2024-39304, which leverages an authenticated SQL injection in ChurchCRM to achieve remote code execution by writing a malicious PHP file to the server.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H