CVE-2025-1133

Summary

CVE-2025-1133 is a vulnerability affecting ChurchCRM versions 5.13.0 and older. It allows attackers with Administrator privileges to perform arbitrary SQL queries through a boolean-based blind SQL Injection vulnerability in the EditEventAttendees functionality. The EID parameter is directly incorporated into an SQL query without proper sanitization, leaving it susceptible to SQL injection attacks. By manipulating the query, an attacker can potentially exfiltrate, modify, or delete sensitive data.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.