CVE-2025-1023 is a critical time-based blind SQL injection, scored 9.8, in ChurchCRM 5.13.0 and prior. It sits in the EditEventTypes feature, where one parameter is joined straight into a query. The record gives no fixed version, so check ChurchCRM's releases for a patch and restrict access to the admin area.
What's affected
The record says ChurchCRM 5.13.0 and prior are affected. The weak spot is the EditEventTypes functionality, where the newCountName parameter is placed directly into an SQL query without proper sanitisation. The description says this allows queries to be manipulated, with possible data theft, modification or deletion.
The public report referenced by the record is a GitHub issue on the ChurchCRM repository, and it returned a message that the issue has been deleted when I checked. I could not read a vendor advisory or release note, so I cannot confirm which release fixed it. Check the project's releases and security notices before you decide a version is safe, and do not assume that a later version is patched.
The record does not mark the CVE as known exploited.
How to check if you're exposed
Find your ChurchCRM version in the application's footer or system information page. Anything at 5.13.0 or earlier is in scope.
Next, find where the instance is reachable. ChurchCRM holds member and donor data for congregations and is often hosted on a small server or shared hosting. Check whether the login page is open to the internet and whether the events administration pages require a logged in user with a suitable role.
Then search your source for the parameter name to see how the query is built:
grep -rn "newCountName" /path/to/churchcrm/
If the value is joined into SQL text, the code is exposed. Also check web logs for repeated requests to the event types editing page with slow responses, since a time-based technique shows up as unusual delays.
What to do now
- Find every ChurchCRM instance and note its version.
- Check the ChurchCRM project's releases for a version newer than 5.13.0 that addresses this issue, and upgrade after a backup.
- Restrict access to the application. Use a VPN, an IP allow list, or at least strong unique passwords and multi factor login where available.
- Reduce roles. Only trusted administrators should be able to reach event type administration.
- Make the database account for the application as limited as possible.
- Back up the database, and review it and your logs for unexpected reads or changes.
- If member or donor data may have been exposed, follow your breach notification duties.
Why it matters
This is SQL injection, listed under CWE-89. A value from the request is joined into the text of a database query, so the database cannot tell the program's instructions from the visitor's data. In a time-based blind case, the visitor sees no data directly but can infer it from how long each request takes, which is slow but works well with automation.
The 9.8 score reflects network reach, low complexity and high impact on confidentiality, integrity and availability. The data in a church management system is personal: names, addresses, family links and giving history. That makes even a modest hosting setup a real privacy risk.
The long term fix is the standard one: parameterised queries everywhere user input meets SQL.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
What is a time-based blind SQL injection?
The application does not show query results, but an attacker can learn data by measuring how long the server takes to respond. It is slower than other forms but still effective.
Which ChurchCRM version fixes it?
The record does not say, and I could not read a vendor advisory. Check the project's releases and security notices.
Sources
Last reviewed: 19 October 2026.
