Date: January 7, 2026
Researcher: Nguyen Truong Son (truongson526@gmail.com)

Summary

A critical SQL Injection vulnerability exists in endpoint /PaddleNumEditor.php in ChurchCRM 6.6.1. Any authenticated user, including one with zero assigned permissions, can exploit SQL injection through the PerID parameter.

Details

The issue is located in: src/PaddleNumEditor.php
Vulnerable code:
Lines 42-43:

$iNum = InputUtils::legacyFilterInput($_POST['Num']);
$iPerID = InputUtils::legacyFilterInput($_POST['PerID']);

Line 51:
$sqlNumBought = 'SELECT mb_count from multibuy_mb WHERE mb_per_ID=' . $iPerID . ' AND mb_item_ID=' . $di_ID;

• The values ​​of $iNum and $iPerID are not cast to int type. They are then directly appended to the query on line 51, no escaping, quoting, type enforcement, or parameter binding is applied.

• Malicious payloads containing ) or -- break logic and execute the vulnerable SQL.

• Even a user with zero permissions can exploit the vulnerability.

• A SLEEP(5) payload reliably delays the response, proving SQL execution.

PoC

Video PoC (SQL injection.mkv): https://drive.google.com/drive/u/0/folders/12baz_wj1_MGeMZe6ah5NxqGDlitJFw_e

1. Log in using user attacker_1 (zero permissions)

2. Go to Fundraiser -> Create New Fundraiser -> Save

3. Click Add Donated Item

4. Name the item, and make sure to check the Sell to everyone (Multiple items) option.

5. Click Save

6. Go to Add Donors to Buyer List, then click Add Buyer

7. Click Save

8. Observing the Burp Proxy, we see a POST request to /PaddleNumEditor.php

9. Replace the value of PerID with -1 or sleep(5)-- -. The response returns after 5 seconds.

10. Check again with sleep(10)

11. Exploiting with sqlmap

• Save the request to the file request.txt

• Extract databases

Impact

• Complete database compromise (read/write/delete)
• Extraction of all sensitive ChurchCRM data
• Possible privilege escalation
• Potential for RCE depending on SQL functions and configuration