Description:

CVE-2024-25897 is a Blind SQL Injection vulnerability in ChurchCRM 5.5.0 FRCatalog.php, allowing attackers to execute arbitrary SQL queries via the CurrentFundraiser GET parameter. The CVSS score of 9.8 indicates a critical severity, while the SOCRadar Vulnerability Risk Score (SVRS) of 42 highlights the urgency of addressing this threat.

Key Insights:

• Exploitation in the Wild: Active exploits have been published, indicating that hackers are actively exploiting this vulnerability.
• High Impact: Blind SQL Injection vulnerabilities can lead to data theft, database manipulation, and website compromise.
• Widely Used Software: ChurchCRM is a popular church management software, increasing the potential impact of this vulnerability.
• Threat Actors: Specific threat actors or APT groups exploiting this vulnerability have not been identified.

Mitigation Strategies:

• Update Software: Install the latest version of ChurchCRM (5.5.1) to patch the vulnerability.
• Implement Input Validation: Validate user input to prevent malicious SQL queries from being executed.
• Use a Web Application Firewall (WAF): Configure a WAF to block malicious requests and protect against SQL injection attacks.
• Monitor for Suspicious Activity: Regularly monitor logs and network traffic for any suspicious activity that may indicate exploitation attempts.

Additional Information:

• The Cybersecurity and Infrastructure Security Agency (CISA) has not issued a warning for this vulnerability.
• Users with additional queries can use the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information.