This vulnerability in andy_moyle Church Admin (<= 5.0.18) allows an attacker to perform SQL Injection due to improper neutralization of special elements in SQL commands. The vulnerability is remotely exploitable without authentication or user interaction, potentially leading to high confidentiality impact and some availability impact. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L, reflecting a critical severity. No patch or vendor advisory details are available to confirm remediation status.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially exposing sensitive data (high confidentiality impact) and causing limited disruption to service availability (low availability impact). Integrity impact is not indicated. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting network access to the application and monitor for suspicious activity related to SQL injection attempts. Avoid exposing the application directly to untrusted networks.