There is a SQL Injection vulnerability in ChurchCRM 4.4.5 via the 'PersonID' field in /churchcrm/WhyCameEditor.php.
SQL Injection vulnerability in ChurchCRM 4.4.5 via /churchcrm/WhyCameEditor.php.

Step to exploit:

1. Login as admin.
2. Redirect to profile page and click on `Edit "Why Came" Notes`.
![1](https://user-images.githubusercontent.com/35623498/168865685-a517909c-ba50-4f17-9b9f-cce5a357a2c3.PNG)

3. Submit "Why Came" notes and capture request in Burp Suite.
![2](https://user-images.githubusercontent.com/35623498/168865810-1732b19c-f2e8-426f-ad3f-4bd44a74b06b.PNG)

4. Save request to churchcrm.txt file and run sqlmap for injecting the PersonID parameter:  `sqlmap -r churchcrm.txt -p PersonID`
![3](https://user-images.githubusercontent.com/35623498/168865953-18a306c8-92a2-43d8-bf9d-e78787b82e54.PNG)
![4](https://user-images.githubusercontent.com/35623498/168866427-70276955-96b1-4ad4-807b-0e9f71844746.PNG)

SQL Injection vulnerability in ChurchCRM 4.4.5 via /churchcrm/WhyCameEditor.php
This is a GitHub Issue
repo:CRM
owner:ChurchCRM
Title : SQL Injection vulnerability in ChurchCRM 4.4.5 via /churchcrm/WhyCameEditor.php
Issue date:

--- start body ---
SQL Injection vulnerability in ChurchCRM 4.4.5 via /churchcrm/WhyCameEditor.php.

Step to exploit:

1. Login as admin.
2. Redirect to profile page and click on `Edit "Why Came" Notes`.
![1](https://user-images.githubusercontent.com/35623498/168865685-a517909c-ba50-4f17-9b9f-cce5a357a2c3.PNG)

3. Submit "Why Came" notes and capture request in Burp Suite.
![2](https://user-images.githubusercontent.com/35623498/168865810-1732b19c-f2e8-426f-ad3f-4bd44a74b06b.PNG)

4. Save request to churchcrm.txt file and run sqlmap for injecting the PersonID parameter:  `sqlmap -r churchcrm.txt -p PersonID`
![3](https://user-images.githubusercontent.com/35623498/168865953-18a306c8-92a2-43d8-bf9d-e78787b82e54.PNG)
![4](https://user-images.githubusercontent.com/35623498/168866427-70276955-96b1-4ad4-807b-0e9f71844746.PNG)

--- end body ---
