| Название | ChurchCRM <= 5.18.0 Remote Code Execution (RCE) |
|---|
| Описание | Critical pre-authentication remote code execution in ChurchCRM setup wizard. Attackers can inject arbitrary PHP code via setup form parameters that are directly concatenated into executable configuration files without validation, achieving immediate server compromise during mandatory installation process. |
|---|
| Источник | ⚠️ https://github.com/uartu0/advisories/blob/main/churchcrm-setup-rce-2025.md |
|---|
| Пользователь | uartu0 (UID 90021) |
|---|
| Представление | 08.10.2025 04:45 (1 Год назад) |
|---|
| Модерация | 18.10.2025 14:54 (10 days later) |
|---|
| Статус | принято |
|---|
| Запись VulDB | 329014 [ChurchCRM до 5.18.0 setup/routes/setup.php DB_PASSWORD/ROOT_PATH/URL эскалация привилегий] |
|---|
| Баллы | 17 |
|---|