This vulnerability in Church Admin arises from improper neutralization of special elements used in SQL commands, commonly known as SQL Injection. It affects versions up to and including 4.0.27. The CVSS 3.1 base score is 8.5, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and a scope change. The impact is high confidentiality loss and low availability impact, with no integrity impact. No patch or official remediation guidance is currently available from the vendor, and the software is not a cloud service.

Successful exploitation could allow an attacker with low privileges to execute crafted SQL commands, potentially leading to unauthorized disclosure of sensitive data (high confidentiality impact). The vulnerability does not affect data integrity but may cause limited denial of service (availability impact). There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting database access privileges and monitor for unusual database activity related to Church Admin. Avoid exposing the application to untrusted networks if possible.