Description:

CVE-2024-39304 is an authenticated SQL injection vulnerability in ChurchCRM, an open-source church management system. It allows attackers to inject SQL statements into the database query due to improper sanitization of user input. The vulnerability has a CVSS score of 8.8, indicating high severity. However, the SOCRadar Vulnerability Risk Score (SVRS) is 50, suggesting a moderate level of urgency.

Key Insights:

• Authentication Required: Attackers need to be authenticated to exploit this vulnerability, but no elevated privileges are necessary.
• SQL Injection: The vulnerability allows attackers to execute arbitrary SQL queries on the database, potentially leading to data theft, modification, or deletion.
• Active Exploitation: The vulnerability is actively exploited in the wild, making it a high-priority threat.

Mitigation Strategies:

• Update to Version 5.9.2: The vendor has released version 5.9.2, which patches the vulnerability. Users should update to this version immediately.
• Implement Input Validation: Implement robust input validation mechanisms to prevent malicious SQL queries from being executed.
• Use a Web Application Firewall (WAF): A WAF can help detect and block malicious SQL injection attempts.
• Monitor for Suspicious Activity: Monitor logs and network traffic for any suspicious activity that may indicate an SQL injection attack.

Additional Information:

• Threat Actors/APT Groups: No specific threat actors or APT groups have been identified as actively exploiting this vulnerability.
• Exploit Status: Active exploits have been published.
• CISA Warnings: The Cybersecurity and Infrastructure Security Agency (CISA) has warned of the vulnerability, calling for immediate and necessary measures.

If users have additional queries regarding this incident, they can use the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information if necessary.