**Description**

A clear and concise description of the reported bug:

- ChurchCRM version: 5.7.0

**Steps To Reproduce**

1. Go to 'https://sitecom/ChurchCRM/EventAttendance.php?Action=List&Event=1%20or%20sleep(10)'
2. See error

**Expected behavior**

A clear and concise description of what you expected to happen.

**Finding**

Title: SQL Injection Vulnerability in EventAttendance.php

Description:
The EventAttendance.php script in ChurchCRM version [insert version if available] is vulnerable to SQL injection. An attacker can exploit this vulnerability by manipulating the 'Event' parameter in the URL. This parameter is directly interpolated into the SQL query without proper sanitization or validation, allowing attackers to execute arbitrary SQL commands.

Vulnerable URL:
https://sitecom/ChurchCRM/EventAttendance.php?Action=List&Event=1%20or%20sleep(10)

Vulnerable Code:
[Link to vulnerable code](https://github.com/ChurchCRM/CRM/blob/b99738a30444068d2cce31fe709d7a93ac524e64/src/EventAttendance.php#L27)

Mitigation:
To mitigate this vulnerability, implement parameterized queries or prepared statements to handle user input securely. This ensures that user-supplied data is properly sanitized and treated as data rather than executable code.

Code snippet:

```php
$sSQL = 'SELECT * FROM events_event WHERE event_type = ? ORDER BY event_start';
$stmt = $mysqli->prepare($sSQL);
$stmt->bind_param("i", $_GET['Event']); // "i" indicates the parameter is an integer
$stmt->execute();
$rsOpps = $stmt->get_result();

Bug: SQL Injection Vulnerability in EventAttendance.php
This is a GitHub Issue
repo:CRM
owner:ChurchCRM
Title : Bug: SQL Injection Vulnerability in EventAttendance.php
Issue date:

--- start body ---
**Description**

A clear and concise description of the reported bug:

- ChurchCRM version: 5.7.0

**Steps To Reproduce**

1. Go to 'https://sitecom/ChurchCRM/EventAttendance.php?Action=List&Event=1%20or%20sleep(10)'
2. See error

**Expected behavior**

A clear and concise description of what you expected to happen.

**Finding**

Title: SQL Injection Vulnerability in EventAttendance.php

Description:
The EventAttendance.php script in ChurchCRM version [insert version if available] is vulnerable to SQL injection. An attacker can exploit this vulnerability by manipulating the 'Event' parameter in the URL. This parameter is directly interpolated into the SQL query without proper sanitization or validation, allowing attackers to execute arbitrary SQL commands.

Vulnerable URL:
https://sitecom/ChurchCRM/EventAttendance.php?Action=List&Event=1%20or%20sleep(10)

Vulnerable Code:
[Link to vulnerable code](https://github.com/ChurchCRM/CRM/blob/b99738a30444068d2cce31fe709d7a93ac524e64/src/EventAttendance.php#L27)

Mitigation:
To mitigate this vulnerability, implement parameterized queries or prepared statements to handle user input securely. This ensures that user-supplied data is properly sanitized and treated as data rather than executable code.

Code snippet:

```php
$sSQL = 'SELECT * FROM events_event WHERE event_type = ? ORDER BY event_start';
$stmt = $mysqli->prepare($sSQL);
$stmt->bind_param("i", $_GET['Event']); // "i" indicates the parameter is an integer
$stmt->execute();
$rsOpps = $stmt->get_result();

--- end body ---

The EventAttendance.php script in ChurchCRM version 5.7.0 is vulnerable to SQL injection. An attacker can exploit this vulnerability by manipulating the 'Event' parameter in the URL, which is directly interpolated into the SQL query without proper sanitization or validation. This allows for the execution of arbitrary SQL commands, potentially compromising the database.