CyberRota Analysis
AI-GeneratedAn SQL injection vulnerability in CiviCRM allows authenticated staff members to exploit the contact search functionality, enabling them to read the entire database due to unsanitized user input in the RLIKE clause. This high-severity flaw can lead to the exfiltration of sensitive data, including donor and member records. Organizations using CiviCRM should prioritize patching this vulnerability to protect their data integrity and confidentiality.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
An SQL injection vulnerability in CiviCRM through 6.18.alpha1 allows authenticated staff to read the entire database via the contact search RLIKE clause. The clause concatenates a user-supplied value into the SQL query without sanitization. An attacker with staff-level access can exfiltrate all database contents including donor and member records.