CVE-2024-39304 PoC — ChurchCRM SQL Injection Vulnerability

Source

https://github.com/apena-ba/CVE-2024-39304

Associated Vulnerability

Title: ChurchCRM SQL Injection Vulnerability (CVE-2024-39304)
Description:ChurchCRM is an open-source church management system. Versions of the application prior to 5.9.2 are vulnerable to an authenticated SQL injection due to an improper sanitization of user input. Authentication is required, but no elevated privileges are necessary. This allows attackers to inject SQL statements directly into the database query due to inadequate sanitization of the EID parameter in in a GET request to `/GetText.php`. Version 5.9.2 patches the issue.

Readme

## Description

This script is a PoC for CVE-2024-39304, where a SQLi is possible due to a lack of sanitization in the ChurchCRM project.

## Usage

```python3 CVE-2024-39304.py -u <USERNAME> -p <PASSWORD> -b <URL> -v```

Example: ```python3 CVE-2024-39304.py -u FirstLast -p Password123 -b http://localhost/churchcrm -v```

## Links
- https://github.com/ChurchCRM/CRM/security/advisories/GHSA-2rh6-gr3h-83j9
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-39304

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →