| 标题 | ChurchCRM <= 5.18.0 Remote Code Execution (RCE) |
|---|
| 描述 | Critical pre-authentication remote code execution in ChurchCRM setup wizard. Attackers can inject arbitrary PHP code via setup form parameters that are directly concatenated into executable configuration files without validation, achieving immediate server compromise during mandatory installation process. |
|---|
| 来源 | ⚠️ https://github.com/uartu0/advisories/blob/main/churchcrm-setup-rce-2025.md |
|---|
| 用户 | uartu0 (UID 90021) |
|---|
| 提交 | 2025-10-08 04時45分 (1 年前) |
|---|
| 管理 | 2025-10-18 14時54分 (10 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 329014 [ChurchCRM 直到 5.18.0 setup/routes/setup.php DB_PASSWORD/ROOT_PATH/URL 权限提升] |
|---|
| 积分 | 17 |
|---|