CVE-2023-29842

Description

ChurchCRM 4.5.4 endpoint /EditEventTypes.php is vulnerable to Blind SQL Injection (Time-based) via the EN_tyid POST parameter.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

References

• https://github.com/ChurchCRM/CRM ↗
• https://github.com/arvandy/CVE/blob/main/CVE-2023-29842/CVE-2023-29842.py ↗
• https://github.com/arvandy/CVE/blob/main/CVE-2023-29842/CVE-2023-29842.md ↗
• http://packetstormsecurity.com/files/175105/ChurchCRM-4.5.4-SQL-Injection.html ↗