| عنوان | ChurchCRM <= 5.18.0 Remote Code Execution (RCE) |
|---|
| الوصف | Critical pre-authentication remote code execution in ChurchCRM setup wizard. Attackers can inject arbitrary PHP code via setup form parameters that are directly concatenated into executable configuration files without validation, achieving immediate server compromise during mandatory installation process. |
|---|
| المصدر | ⚠️ https://github.com/uartu0/advisories/blob/main/churchcrm-setup-rce-2025.md |
|---|
| المستخدم | uartu0 (UID 90021) |
|---|
| ارسال | 08/10/2025 04:45 AM (1 سنة منذ) |
|---|
| الاعتدال | 18/10/2025 02:54 PM (10 days later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 329014 [ChurchCRM حتى 5.18.0 setup/routes/setup.php DB_PASSWORD/ROOT_PATH/URL تجاوز الصلاحيات] |
|---|
| النقاط | 17 |
|---|