CVE-2025-11938
BaseFortify
Publication date: 2025-10-19
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| churchcrm | churchcrm | to 5.18.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-20 | The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. |
| CWE-502 | The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in ChurchCRM up to version 5.18.0 involves unsafe deserialization of untrusted input passed through parameters DB_PASSWORD, ROOT_PATH, or URL in the file setup/routes/setup.php. An attacker can remotely manipulate these parameters to trigger deserialization without proper validation, potentially leading to remote code execution. The vulnerability affects confidentiality, integrity, and availability of the system and can be exploited without authentication, although the attack complexity is high. No official fixes or mitigations are available. [1, 3]
How can this vulnerability impact me? :
Exploitation of this vulnerability can lead to remote code execution on the affected server, allowing attackers to compromise the system fully. This impacts the confidentiality, integrity, and availability of the system, potentially resulting in unauthorized data access, data manipulation, or service disruption. Since the exploit is publicly available and requires no authentication, the risk is significant despite the high complexity of the attack. [1, 3]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by scanning for the presence of the vulnerable file setup/routes/setup.php in ChurchCRM versions up to 5.18.0. Additionally, attackers may be identified by monitoring for requests manipulating the parameters DB_PASSWORD, ROOT_PATH, or URL in HTTP requests to this path. Google dorking with the query "inurl:setup/routes/setup.php" can help identify vulnerable targets externally. On your system, you can search for the vulnerable file using commands like `find / -path '*setup/routes/setup.php'` and inspect web server logs for suspicious requests containing these parameters. Network IDS/IPS rules can be created to alert on HTTP requests with these parameters targeting the setup.php route. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include discontinuing use of ChurchCRM versions up to 5.18.0 and replacing them with a secure alternative, as no official patches or mitigations are available. Restricting access to the setup/routes/setup.php file via network controls or web server configuration (e.g., IP whitelisting or disabling the setup wizard after installation) can reduce exposure. Monitoring and blocking suspicious requests targeting the vulnerable parameters (DB_PASSWORD, ROOT_PATH, URL) is also recommended. Since the vendor has not provided a fix, avoiding use of the affected versions is the safest approach. [1]