CVE-2023-38768

Summary

CVE-2023-38768 is a newly disclosed SQL injection vulnerability that affects ChurchCRM version 5.0.0. An attacker can exploit this flaw by manipulating the PropertyID parameter in the /QueryView.php file, enabling them to gain unauthorized access to sensitive information remotely. Successful exploitation of this vulnerability could lead to significant data breaches, potentially including personal information or financial data. It is recommended that users upgrade to the latest version of ChurchCRM to mitigate this risk. Failure to address this vulnerability could result in costly data breaches and reputational damage.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.