EcclesiaCRM versions up to 8.0.0 contain an SQL injection vulnerability (CWE-89) in the ValidateInput() function used in query views. The function improperly handles user-supplied POST parameters by applying str_replace without sanitization for non-standard validation types. This flaw enables injection of malicious SQL code. The vulnerability is a result of an incomplete remediation attempt for CVE-2026-35184. The CVSS 4.0 base score is 8.7, indicating high severity with network attack vector, low attack complexity, no user interaction, and high impacts on confidentiality, integrity, and availability.

An attacker with limited privileges can exploit this vulnerability remotely without user interaction to execute arbitrary SQL commands on the EcclesiaCRM database. This can lead to unauthorized data disclosure, modification, or deletion, severely impacting the confidentiality, integrity, and availability of the system's data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently available. Until a patch is released, users should avoid exposing vulnerable versions to untrusted networks and consider applying custom input validation or query parameter sanitization as a temporary mitigation.