ChurchCRM Unauthenticated RCE via Setup Page

MetasploitMetasploit exploitExploitRubyexploit_multi/http/churchcrm_install_unauth_rce

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

Metasploit
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Metasploit module that exploits CVE-2025-62521 to achieve unauthenticated remote code execution on ChurchCRM <= 6.8.0 by injecting PHP code into the DB_PASSWORD field of the setup form, which is written to Include/Config.php and executed on subsequent requests.

Backdoor review

No backdoor observed in reviewed code

The Metasploit module exploits CVE-2025-62521 to achieve remote code execution on a vulnerable ChurchCRM instance. All observed behavior is consistent with the documented exploit: injecting a PHP payload into the configuration file and triggering it. No concealed backdoor, credential theft, persistence, or unrelated payload delivery was found.

ClassificationExploit
Model confidence100%
AuthenticationNot required
Languagesruby
Target softwareChurchCRM
Attack typescode injectionremote code execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a complete Metasploit exploit module that actively injects and executes attacker-controlled code on a remote target. It includes a check method for vulnerability detection, but its primary purpose is exploitation, as it constructs payloads, writes them to the target's filesystem, and triggers their execution to establish a session.

modules/exploits/multi/http/churchcrm_install_unauth_rce.rb:6modules/exploits/multi/http/churchcrm_install_unauth_rce.rb:95-99modules/exploits/multi/http/churchcrm_install_unauth_rce.rb:107-125modules/exploits/multi/http/churchcrm_install_unauth_rce.rb:127-144modules/exploits/multi/http/churchcrm_install_unauth_rce.rb:146-156

Requirements

  • Target must be running a vulnerable version of ChurchCRM (<= 6.8.0) with the setup page accessible.modules/exploits/multi/http/churchcrm_install_unauth_rce.rb:20-21modules/exploits/multi/http/churchcrm_install_unauth_rce.rb:90

Observed behavior

  • Sends a GET request to the setup page to check if the target is vulnerable by inspecting the CRM-VERSION header.modules/exploits/multi/http/churchcrm_install_unauth_rce.rb:82-92
  • Constructs a PHP payload that breaks out of a string assignment and injects arbitrary code, then sends it in a POST request to the setup page's DB_PASSWORD field.modules/exploits/multi/http/churchcrm_install_unauth_rce.rb:110-122modules/exploits/multi/http/churchcrm_install_unauth_rce.rb:127-144
  • Triggers execution of the injected PHP code by making a GET request to the application root, which includes the modified Config.php.modules/exploits/multi/http/churchcrm_install_unauth_rce.rb:146-156
  • For Linux targets, uses a command stager to execute arbitrary system commands via a GET parameter.modules/exploits/multi/http/churchcrm_install_unauth_rce.rb:139-140modules/exploits/multi/http/churchcrm_install_unauth_rce.rb:147-151modules/exploits/multi/http/churchcrm_install_unauth_rce.rb:158-164
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Mechanism
PHP code injection via DB_PASSWORD field in setup formThe module sends a POST request with a crafted DB_PASSWORD value that breaks out of the string context and injects PHP code into Include/Config.php.modules/exploits/multi/http/churchcrm_install_unauth_rce.rb:110-125modules/exploits/multi/http/churchcrm_install_unauth_rce.rb:127-144
Payload Delivery
Metasploit payload execution via eval, file fetch, or command stagerThe injected PHP code executes the user-selected Metasploit payload using eval(base64_decode(...)), file_get_contents/include, or system($_GET[...]).modules/exploits/multi/http/churchcrm_install_unauth_rce.rb:130-141
Cleanup Behavior
Removal of injected Config.php after cmdstager executionThe module attempts to delete the modified configuration file to reduce forensic evidence.modules/exploits/multi/http/churchcrm_install_unauth_rce.rb:150
Review boundaries

What the analysis did not establish

  • The analysis is based solely on the provided Metasploit module source code and metadata; framework mixins, libraries, and external payloads are not expanded, so the full runtime behavior of the exploit cannot be confirmed from this evidence alone.
  • Only the module source and metadata were reviewed; Metasploit framework mixins, libraries, and external payloads were not expanded or analyzed.
  • The actual behavior of the payloads (e.g., meterpreter) is outside the scope of this review.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1