ChurchCRM Database Restore RCE 6.2.0
PoC files
1 fileFile viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.
Analysis
Technical assessment
A Metasploit module that exploits an authenticated RCE vulnerability in ChurchCRM's database restore functionality by uploading a .htaccess bypass and a PHP payload, then executing it to obtain a shell.
Backdoor review
No backdoor observed in reviewed code
The module is a standard Metasploit exploit for CVE-2025-68109. It authenticates to ChurchCRM, uploads a .htaccess and a PHP payload via the database restore endpoint, and executes the payload. All behavior is consistent with the described exploit and no concealed backdoor, credential theft, persistence, or unrelated payload delivery was observed.
Classification basis and observed behavior
Classification basis
The module is a complete Metasploit exploit that actively uploads a malicious PHP file and executes it to gain a shell on the target. It includes authentication, file upload, and payload execution logic, which constitutes exploitation, not just detection or scanning.
modules/exploits/multi/http/churchcrm_db_restore_rce.rb:217-233Requirements
- Valid administrative credentials for the target ChurchCRM instance.
modules/exploits/multi/http/churchcrm_db_restore_rce.rb:76-77 - Target ChurchCRM version prior to 6.5.3.
modules/exploits/multi/http/churchcrm_db_restore_rce.rb:98-99
Observed behavior
- Authenticates to the target using provided credentials and retrieves a session cookie.
modules/exploits/multi/http/churchcrm_db_restore_rce.rb:130-151 - Uploads a .htaccess file to bypass access restrictions in the backup directory.
modules/exploits/multi/http/churchcrm_db_restore_rce.rb:225 - Uploads a PHP payload file via the database restore endpoint.
modules/exploits/multi/http/churchcrm_db_restore_rce.rb:228-229 - Executes the uploaded PHP payload by sending an HTTP GET request to the payload's URL, resulting in remote code execution.
modules/exploits/multi/http/churchcrm_db_restore_rce.rb:199-214
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Uploads .htaccess and PHP payload to ChurchCRM backup directoryThe exploit uploads a .htaccess file to allow access and a PHP file containing the Metasploit payload, then triggers execution. This matches the CVE description.
modules/exploits/multi/http/churchcrm_db_restore_rce.rb:225-232 - Payload Generation
- Generates PHP payloads using standard Metasploit payload APIThe build_payload method creates PHP code that either executes an in-memory payload, fetches a payload from the module's HTTP server, or provides a simple command execution webshell. All payloads use the standard Metasploit payload.encoded.
modules/exploits/multi/http/churchcrm_db_restore_rce.rb:114-125 - Authentication
- Uses supplied USERNAME and PASSWORD to obtain session cookieThe module authenticates to the target ChurchCRM instance using credentials provided by the operator. No hardcoded credentials or credential exfiltration is present.
modules/exploits/multi/http/churchcrm_db_restore_rce.rb:130-151
What the analysis did not establish
- Analysis is based solely on the module source code and metadata; framework mixins, libraries, and external payloads are not expanded, so the exact behavior of included components like CmdStager or HttpServer is not verified.
- The evidence does not include runtime execution or network traffic, so the actual success or reliability of the exploit cannot be confirmed.
- Review is limited to the module source code; Metasploit framework mixins, libraries, and external payloads are not expanded or analyzed.
- Binary files were not inspected (none present in evidence).
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.