github.comConfirmation
https://github.com/ChurchCRM/CRM/security/advisories/GHSA-m8jq-j3p9-2xf3 CVE-2025-62521
CRITICAL
ChurchCRM has unauthenticated RCE in its Install Wizard
Record summary
CVE-2025-62521 has a selected CVSS score of 10.0 (critical); EIP currently links 1 catalogued exploit.
Description
ChurchCRM is an open-source church management system. Prior to version 5.21.0, a pre-authentication remote code execution vulnerability in ChurchCRM's setup wizard allows unauthenticated attackers to inject arbitrary PHP code during the initial installation process, leading to complete server compromise. The vulnerability exists in `setup/routes/setup.php` where user input from the setup form is directly concatenated into a PHP configuration template without any validation or sanitization. Any parameter in the setup form can be used to inject PHP code that gets written to `Include/Config.php`, which is then executed on every page load. This is more severe than typical authenticated RCE vulnerabilities because it requires no credentials and affects the installation process that administrators must complete. Version 5.21.0 patches the issue.
Description source: CVE List
Exploitation context
Available material
- Catalogued exploits
- 1
CISA SSVC decision
ExploitationPoC
AutomatableYes
Technical impactTotal
CISA Coordinator · SSVC 2.0.3 · Evaluated Dec 17, 2025 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
| CVE List | < 5.21.0 | affected |
Proofs of concept
1Catalogued exploits
MetasploitChurchCRM Unauthenticated RCE via Setup PageMetasploit exploitby Arthur Valverde (uartu0) +1 moreExploit1 file
Analysis
Technical assessment
A Metasploit module that exploits CVE-2025-62521 to achieve unauthenticated remote code execution on ChurchCRM <= 6.8.0 by injecting PHP code into the DB_PASSWORD field of the setup form, which is written to Include/Config.php and executed on subsequent requests.
Backdoor review
No backdoor observed in reviewed code
The Metasploit module exploits CVE-2025-62521 to achieve remote code execution on a vulnerable ChurchCRM instance. All observed behavior is consistent with the documented exploit: injecting a PHP payload into the configuration file and triggering it. No concealed backdoor, credential theft, persistence, or unrelated payload delivery was found.
ClassificationExploit
Model confidence100%
AuthenticationNot required
Languages
Target software
Attack types
Evidence & reasoningClassification basis · observed behavior · safety review
Classification basis and observed behavior
Classification basis
The artifact is a complete Metasploit exploit module that actively injects and executes attacker-controlled code on a remote target. It includes a check method for vulnerability detection, but its primary purpose is exploitation, as it constructs payloads, writes them to the target's filesystem, and triggers their execution to establish a session.
modules/exploits/multi/http/churchcrm_install_unauth_rce.rb:6modules/exploits/multi/http/churchcrm_install_unauth_rce.rb:95-99modules/exploits/multi/http/churchcrm_install_unauth_rce.rb:107-125modules/exploits/multi/http/churchcrm_install_unauth_rce.rb:127-144modules/exploits/multi/http/churchcrm_install_unauth_rce.rb:146-156Requirements
- Target must be running a vulnerable version of ChurchCRM (<= 6.8.0) with the setup page accessible.
modules/exploits/multi/http/churchcrm_install_unauth_rce.rb:20-21modules/exploits/multi/http/churchcrm_install_unauth_rce.rb:90
Observed behavior
- Sends a GET request to the setup page to check if the target is vulnerable by inspecting the CRM-VERSION header.
modules/exploits/multi/http/churchcrm_install_unauth_rce.rb:82-92 - Constructs a PHP payload that breaks out of a string assignment and injects arbitrary code, then sends it in a POST request to the setup page's DB_PASSWORD field.
modules/exploits/multi/http/churchcrm_install_unauth_rce.rb:110-122modules/exploits/multi/http/churchcrm_install_unauth_rce.rb:127-144 - Triggers execution of the injected PHP code by making a GET request to the application root, which includes the modified Config.php.
modules/exploits/multi/http/churchcrm_install_unauth_rce.rb:146-156 - For Linux targets, uses a command stager to execute arbitrary system commands via a GET parameter.
modules/exploits/multi/http/churchcrm_install_unauth_rce.rb:139-140modules/exploits/multi/http/churchcrm_install_unauth_rce.rb:147-151modules/exploits/multi/http/churchcrm_install_unauth_rce.rb:158-164
Behaviors behind the backdoor verdict
Observables
- Exploit Mechanism
- Payload withheldThe module sends a POST request with a crafted DB_PASSWORD value that breaks out of the string context and injects PHP code into Include/Config.php.
modules/exploits/multi/http/churchcrm_install_unauth_rce.rb:110-125modules/exploits/multi/http/churchcrm_install_unauth_rce.rb:127-144 - Payload Delivery
- Payload withheldThe injected PHP code executes the user-selected Metasploit payload using eval(base64_decode(...)), file_get_contents/include, or system($_GET[...]).
modules/exploits/multi/http/churchcrm_install_unauth_rce.rb:130-141 - Cleanup Behavior
- Payload withheldThe module attempts to delete the modified configuration file to reduce forensic evidence.
modules/exploits/multi/http/churchcrm_install_unauth_rce.rb:150
What the analysis did not establish
- The analysis is based solely on the provided Metasploit module source code and metadata; framework mixins, libraries, and external payloads are not expanded, so the full runtime behavior of the exploit cannot be confirmed from this evidence alone.
- Only the module source and metadata were reviewed; Metasploit framework mixins, libraries, and external payloads were not expanded or analyzed.
- The actual behavior of the payloads (e.g., meterpreter) is outside the scope of this review.
Model interpretation
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.