CVE-2025-1134

Summary

CVE-2025-1134 is a vulnerability affecting ChurchCRM 5.13.0 and earlier versions. It allows attackers to execute arbitrary SQL queries through a boolean-based and time-based blind SQL Injection vulnerability in the DonatedItemEditor functionality. The CurrentFundraiser parameter is directly concatenated into SQL queries without adequate sanitization, enabling manipulation and potential execution of malicious commands. Consequences of this vulnerability include data exfiltration, modification, and deletion. To exploit the vulnerability, an attacker must have Administrator privileges.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.