{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-09-30T10:19:13.178","vulnerabilities":[{"cve":{"id":"CVE-2025-1132","sourceIdentifier":"b7efe717-a805-47cf-8e9a-921fca0ce0ce","published":"2025-02-19T09:15:10.417","lastModified":"2026-06-17T08:38:26.330","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A time-based blind SQL Injection vulnerability exists in the ChurchCRM 5.13.0 and prior EditEventAttendees.php within the EN_tyid parameter. The parameter is directly inserted into an SQL query without proper sanitization, allowing attackers to inject malicious SQL commands. Please note that the vulnerability requires Administrator permissions. This flaw can potentially allow attackers to delay the response, indicating the presence of an SQL injection vulnerability. While it is a time-based blind injection, it can be exploited to gain insights into the underlying database, and with further exploitation, sensitive data could be retrieved."},{"lang":"es","value":"Existe una vulnerabilidad de inyección Blind SQL basada en el tiempo en ChurchCRM 5.13.0 y anteriores EditEventAttendees.php dentro del parámetro EN_TYID. El parámetro se inserta directamente en una consulta SQL sin la depuración adecuada, lo que permite a los atacantes inyectar comandos SQL maliciosos. Tenga en cuenta que la vulnerabilidad requiere permisos de administrador. Este defecto puede permitir potencialmente a los atacantes retrasar la respuesta, lo que indica la presencia de una vulnerabilidad de inyección SQL. Si bien es una inyección ciega basada en el tiempo, se puede explotar para obtener información sobre la base de datos subyacente, y con una mayor explotación, se pueden recuperar datos confidenciales."}],"affected":[{"source":"b7efe717-a805-47cf-8e9a-921fca0ce0ce","affectedData":[{"vendor":"ChurchCRM","product":"ChurchCRM","defaultStatus":"unaffected","versions":[{"version":"ChurchCRM 5.13.0 and prior","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"b7efe717-a805-47cf-8e9a-921fca0ce0ce","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:H/U:Red","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"LOW","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"YES","Recovery":"USER","valueDensity":"CONCENTRATED","vulnerabilityResponseEffort":"HIGH","providerUrgency":"RED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-02-19T15:05:51.123288Z","id":"CVE-2025-1132","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"b7efe717-a805-47cf-8e9a-921fca0ce0ce","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-89"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:churchcrm:churchcrm:*:*:*:*:*:*:*:*","versionEndIncluding":"5.13.0","matchCriteriaId":"552A51B0-B2AE-4A12-BF43-DDCE1D8A29D2"}]}]}],"references":[{"url":"https://github.com/ChurchCRM/CRM/issues/7251","source":"b7efe717-a805-47cf-8e9a-921fca0ce0ce","tags":["Exploit","Issue Tracking","Third Party Advisory"]}]}}]}