Executive Summary

This vulnerability in ChurchCRM up to version 5.18.0 involves unsafe deserialization of untrusted input passed through parameters DB_PASSWORD, ROOT_PATH, or URL in the file setup/routes/setup.php. An attacker can remotely manipulate these parameters to trigger deserialization without proper validation, potentially leading to remote code execution. The vulnerability affects confidentiality, integrity, and availability of the system and can be exploited without authentication, although the attack complexity is high. No official fixes or mitigations are available. [1, 3]

Useful 0 Not Useful 0

Impact Analysis

Exploitation of this vulnerability can lead to remote code execution on the affected server, allowing attackers to compromise the system fully. This impacts the confidentiality, integrity, and availability of the system, potentially resulting in unauthorized data access, data manipulation, or service disruption. Since the exploit is publicly available and requires no authentication, the risk is significant despite the high complexity of the attack. [1, 3]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by scanning for the presence of the vulnerable file setup/routes/setup.php in ChurchCRM versions up to 5.18.0. Additionally, attackers may be identified by monitoring for requests manipulating the parameters DB_PASSWORD, ROOT_PATH, or URL in HTTP requests to this path. Google dorking with the query "inurl:setup/routes/setup.php" can help identify vulnerable targets externally. On your system, you can search for the vulnerable file using commands like `find / -path '*setup/routes/setup.php'` and inspect web server logs for suspicious requests containing these parameters. Network IDS/IPS rules can be created to alert on HTTP requests with these parameters targeting the setup.php route. [1]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include discontinuing use of ChurchCRM versions up to 5.18.0 and replacing them with a secure alternative, as no official patches or mitigations are available. Restricting access to the setup/routes/setup.php file via network controls or web server configuration (e.g., IP whitelisting or disabling the setup wizard after installation) can reduce exposure. Monitoring and blocking suspicious requests targeting the vulnerable parameters (DB_PASSWORD, ROOT_PATH, URL) is also recommended. Since the vendor has not provided a fix, avoiding use of the affected versions is the safest approach. [1]

Useful 0 Not Useful 0