LucasCsmt
Source-scoped identity with 2 associated PoCs and 2 linked vulnerabilities.
Exploit catalog results
Showing 2 PoCs on this page
MetasploitChurchCRM Database Restore RCE 6.2.0
Metasploit exploitAdded to Metasploit 2026-03-02ExploitCVE-2025-681091 file
Analysis
Technical assessment
A Metasploit module that exploits an authenticated RCE vulnerability in ChurchCRM's database restore functionality by uploading a .htaccess bypass and a PHP payload, then executing it to obtain a shell.
Backdoor review
No backdoor observed in reviewed code
The module is a standard Metasploit exploit for CVE-2025-68109. It authenticates to ChurchCRM, uploads a .htaccess and a PHP payload via the database restore endpoint, and executes the payload. All behavior is consistent with the described exploit and no concealed backdoor, credential theft, persistence, or unrelated payload delivery was observed.
Classification basis and observed behavior
Classification basis
The module is a complete Metasploit exploit that actively uploads a malicious PHP file and executes it to gain a shell on the target. It includes authentication, file upload, and payload execution logic, which constitutes exploitation, not just detection or scanning.
modules/exploits/multi/http/churchcrm_db_restore_rce.rb:217-233Requirements
- Valid administrative credentials for the target ChurchCRM instance.
modules/exploits/multi/http/churchcrm_db_restore_rce.rb:76-77 - Target ChurchCRM version prior to 6.5.3.
modules/exploits/multi/http/churchcrm_db_restore_rce.rb:98-99
Observed behavior
- Authenticates to the target using provided credentials and retrieves a session cookie.
modules/exploits/multi/http/churchcrm_db_restore_rce.rb:130-151 - Uploads a .htaccess file to bypass access restrictions in the backup directory.
modules/exploits/multi/http/churchcrm_db_restore_rce.rb:225 - Uploads a PHP payload file via the database restore endpoint.
modules/exploits/multi/http/churchcrm_db_restore_rce.rb:228-229 - Executes the uploaded PHP payload by sending an HTTP GET request to the payload's URL, resulting in remote code execution.
modules/exploits/multi/http/churchcrm_db_restore_rce.rb:199-214
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Payload withheldThe exploit uploads a .htaccess file to allow access and a PHP file containing the Metasploit payload, then triggers execution. This matches the CVE description.
modules/exploits/multi/http/churchcrm_db_restore_rce.rb:225-232 - Payload Generation
- Payload withheldThe build_payload method creates PHP code that either executes an in-memory payload, fetches a payload from the module's HTTP server, or provides a simple command execution webshell. All payloads use the standard Metasploit payload.encoded.
modules/exploits/multi/http/churchcrm_db_restore_rce.rb:114-125 - Authentication
- Payload withheldThe module authenticates to the target ChurchCRM instance using credentials provided by the operator. No hardcoded credentials or credential exfiltration is present.
modules/exploits/multi/http/churchcrm_db_restore_rce.rb:130-151
What the analysis did not establish
- Analysis is based solely on the module source code and metadata; framework mixins, libraries, and external payloads are not expanded, so the exact behavior of included components like CmdStager or HttpServer is not verified.
- The evidence does not include runtime execution or network traffic, so the actual success or reliability of the exploit cannot be confirmed.
- Review is limited to the module source code; Metasploit framework mixins, libraries, and external payloads are not expanded or analyzed.
- Binary files were not inspected (none present in evidence).
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
MetasploitChurchCRM Unauthenticated RCE via Setup Page
Metasploit exploitby Arthur Valverde (uartu0)Added to Metasploit 2026-02-03ExploitCVE-2025-625211 file
Analysis
Technical assessment
A Metasploit module that exploits CVE-2025-62521 to achieve unauthenticated remote code execution on ChurchCRM <= 6.8.0 by injecting PHP code into the DB_PASSWORD field of the setup form, which is written to Include/Config.php and executed on subsequent requests.
Backdoor review
No backdoor observed in reviewed code
The Metasploit module exploits CVE-2025-62521 to achieve remote code execution on a vulnerable ChurchCRM instance. All observed behavior is consistent with the documented exploit: injecting a PHP payload into the configuration file and triggering it. No concealed backdoor, credential theft, persistence, or unrelated payload delivery was found.
Classification basis and observed behavior
Classification basis
The artifact is a complete Metasploit exploit module that actively injects and executes attacker-controlled code on a remote target. It includes a check method for vulnerability detection, but its primary purpose is exploitation, as it constructs payloads, writes them to the target's filesystem, and triggers their execution to establish a session.
modules/exploits/multi/http/churchcrm_install_unauth_rce.rb:6modules/exploits/multi/http/churchcrm_install_unauth_rce.rb:95-99modules/exploits/multi/http/churchcrm_install_unauth_rce.rb:107-125modules/exploits/multi/http/churchcrm_install_unauth_rce.rb:127-144modules/exploits/multi/http/churchcrm_install_unauth_rce.rb:146-156Requirements
- Target must be running a vulnerable version of ChurchCRM (<= 6.8.0) with the setup page accessible.
modules/exploits/multi/http/churchcrm_install_unauth_rce.rb:20-21modules/exploits/multi/http/churchcrm_install_unauth_rce.rb:90
Observed behavior
- Sends a GET request to the setup page to check if the target is vulnerable by inspecting the CRM-VERSION header.
modules/exploits/multi/http/churchcrm_install_unauth_rce.rb:82-92 - Constructs a PHP payload that breaks out of a string assignment and injects arbitrary code, then sends it in a POST request to the setup page's DB_PASSWORD field.
modules/exploits/multi/http/churchcrm_install_unauth_rce.rb:110-122modules/exploits/multi/http/churchcrm_install_unauth_rce.rb:127-144 - Triggers execution of the injected PHP code by making a GET request to the application root, which includes the modified Config.php.
modules/exploits/multi/http/churchcrm_install_unauth_rce.rb:146-156 - For Linux targets, uses a command stager to execute arbitrary system commands via a GET parameter.
modules/exploits/multi/http/churchcrm_install_unauth_rce.rb:139-140modules/exploits/multi/http/churchcrm_install_unauth_rce.rb:147-151modules/exploits/multi/http/churchcrm_install_unauth_rce.rb:158-164
Behaviors behind the backdoor verdict
Observables
- Exploit Mechanism
- Payload withheldThe module sends a POST request with a crafted DB_PASSWORD value that breaks out of the string context and injects PHP code into Include/Config.php.
modules/exploits/multi/http/churchcrm_install_unauth_rce.rb:110-125modules/exploits/multi/http/churchcrm_install_unauth_rce.rb:127-144 - Payload Delivery
- Payload withheldThe injected PHP code executes the user-selected Metasploit payload using eval(base64_decode(...)), file_get_contents/include, or system($_GET[...]).
modules/exploits/multi/http/churchcrm_install_unauth_rce.rb:130-141 - Cleanup Behavior
- Payload withheldThe module attempts to delete the modified configuration file to reduce forensic evidence.
modules/exploits/multi/http/churchcrm_install_unauth_rce.rb:150
What the analysis did not establish
- The analysis is based solely on the provided Metasploit module source code and metadata; framework mixins, libraries, and external payloads are not expanded, so the full runtime behavior of the exploit cannot be confirmed from this evidence alone.
- Only the module source and metadata were reviewed; Metasploit framework mixins, libraries, and external payloads were not expanded or analyzed.
- The actual behavior of the payloads (e.g., meterpreter) is outside the scope of this review.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.