Cyber Posture

CVE-2025-1961

MediumPublic PoC

Published: 04 March 2025

Published
04 March 2025
Modified
29 April 2025
KEV Added
Patch
CVSS Score 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0024 46.7th percentile
Risk Priority 13 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may leverage databases to mine valuable information.

Security Summary

CVE-2025-1961 is a critical SQL injection vulnerability in SourceCodester Best Church Management Software version 1.1. The flaw affects an unknown functionality in the file /admin/app/web_crud.php, where manipulation of the "encryption" argument triggers the injection. Classified under CWE-74 and CWE-89, it carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) and was published on 2025-03-04T23:15:10.717. Other parameters may also be vulnerable.

The vulnerability enables remote exploitation by low-privileged users (PR:L) with low attack complexity and no user interaction required. Attackers can achieve limited impacts on confidentiality, integrity, and availability through SQL injection, potentially allowing unauthorized database queries, modifications, or disruptions.

Advisories detail the issue on VulDB (ctiid.298561, id.298561, submit.510865), with a proof-of-concept exploit disclosed publicly on GitHub at https://github.com/Yesec/Best-church-management-software/blob/main/web_crud.php_SQLi.md. The vendor site is available at www.sourcecodester.com.

The exploit has been made public and may be actively used, highlighting the need for immediate assessment in affected environments.

Details

CWE(s)
CWE-74CWE-89

Affected Products

mayurik
best church management software
1.1

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1213.006 Databases Collection
Adversaries may leverage databases to mine valuable information.
Why these techniques?

SQL injection in public-facing web application (/admin/app/web_crud.php) enables initial access via exploitation of public-facing application (T1190) and facilitates collection from databases (T1213.006) through arbitrary SQL query execution.

References