mbanyamer/cve-2026-24854-churchcrm-6.7.2-authenticated-numeric-sql-injectionProof-of-concept demonstrating authenticated numeric SQL injection in ChurchCRM before 6.7.2, enabling logic manipulation to bypass WHERE clauses and affect multiple records. Includes usage instructions, patch details, and mitigation recommendations.
Author: Mohammed Idrees Banyamer
Country: Jordan
Handle: @banyamer_security
GitHub: https://github.com/mbanyamer
This repository contains a Proof of Concept (PoC) demonstrating an authenticated numeric SQL injection vulnerability in ChurchCRM versions prior to 6.7.2.
The vulnerability allows logic manipulation of SQL queries by injecting non-numeric payloads into parameters assumed to be numeric, enabling unauthorized modification of query behavior (e.g., bypassing WHERE clauses).
The vulnerability exists in the following file:
src/PaddleNumEditor.php
The POST parameter PerID is concatenated directly into multiple SQL queries without proper type casting or sanitization. Although intended to be numeric, it can be manipulated to alter SQL logic.
Example vulnerable pattern (conceptual):
DELETE FROM multibuy_mb WHERE mb_per_ID = $PerID AND mb_fr_ID = $frID;
By supplying a payload such as:
0 OR 1=1 --
the WHERE clause logic can be bypassed, potentially transforming a single-record operation into a multi-record or full-table operation.
This vulnerability is not designed for blind data extraction, but for logic abuse affecting UPDATE, DELETE, or INSERT operations.
An authenticated attacker can:
Because this flaw occurs in numeric-only logic, it may bypass basic SQL injection detection and WAF rules.
The PoC demonstrates:
A legitimate request using a numeric PerID that affects only one record.
A crafted numeric SQL injection payload:
0 OR 1=1 --
This payload bypasses WHERE clause restrictions, resulting in multi-record or full-table effects (e.g., mass deletion).
The PoC compares HTTP responses and behavioral differences to confirm successful manipulation.
Install dependency:
pip install requests
Edit the following variables in the PoC script:
TARGET_BASE = "http://localhost/churchcrm"
USERNAME = "admin"
PASSWORD = "yourpassword"
⚠️ Use only a local or authorized test instance
python3 churchcrm_cve-2026-24854_poc.py
To confirm exploitation:
multibuy_mb) before and afterThe is_success_response() function can be tuned to match your instance’s normal vs manipulated responses.
The issue was fixed in ChurchCRM 6.7.2 via commit:
748f5084
Fix details:
(int) casting applied to:
PerIDNum0, preventing injectionUsers should upgrade immediately.
This vulnerability was discovered and responsibly disclosed by:
Mohammed Idrees Banyamer
Jordan
Instagram: @banyamer_security
GitHub: https://github.com/mbanyamer
This Proof of Concept is provided for educational and defensive security purposes only.
Do NOT use this code against systems you do not own or have explicit permission to test.
The author assumes no liability for misuse or damages resulting from this code.