Submit #671083: ChurchCRM <= 5.18.0 Remote Code Execution (RCE)info

TitleChurchCRM <= 5.18.0 Remote Code Execution (RCE)
DescriptionCritical pre-authentication remote code execution in ChurchCRM setup wizard. Attackers can inject arbitrary PHP code via setup form parameters that are directly concatenated into executable configuration files without validation, achieving immediate server compromise during mandatory installation process.
Source⚠️ https://github.com/uartu0/advisories/blob/main/churchcrm-setup-rce-2025.md
User
 uartu0 (UID 90021)
Submission10/08/2025 04:45 (6 months ago)
Moderation10/18/2025 14:54 (10 days later)
StatusAccepted
VulDB entry329014 [ChurchCRM up to 5.18.0 setup/routes/setup.php DB_PASSWORD/ROOT_PATH/URL deserialization]
Points17

Do you know our Splunk app?

Download it now for free!