Horizon Alert
Summary of the vulnerability and why it matters
An incomplete fix for a previous vulnerability exists in ChurchCRM, a church management system. This means an issue that was thought to be resolved can still be exploited through existing proof-of-concept details. This requires attention because it re-exposes the system to the previously addressed security risk.
- Can lead to data compromise.
- Affects users with limited access.
- The fix was unintentionally removed.
Attack Path
How an attacker could exploit the issue
An attacker with low privilege can exploit this vulnerability by targeting the public user API endpoint. The flaw allows an authenticated user to bypass authorization checks and gain unauthorized administrative access to sensitive church data and system functions. This can be achieved by sending a crafted request to the vulnerable API.
- Low-privilege user access required.
- Targets public user API endpoint.
- Incomplete fix for prior vulnerability.
Live Threat
Current exploitation, exposure, and threat context
The fix for this vulnerability in ChurchCRM versions 7.2.0 through 7.2.2 was reverted, leaving the application susceptible to exploitation by a previously published Proof of Concept. This situation suggests a high likelihood of weaponization as the vulnerability remains present in released software.
- Exploitable in released versions.
- Public PoC exists.
- Affects public API.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Prioritize immediate action on ChurchCRM versions 7.2.0 through 7.2.2, as the fix for a critical vulnerability was incomplete and remains exploitable. Teams should focus on upgrading to the patched version or implementing containment measures to prevent exploitation.
- Upgrade to ChurchCRM 7.3.1.
- If patching is delayed, restrict access to the affected API.
- Monitor for indicators of compromise.
