Executive Summary

This vulnerability in ChurchCRM versions prior to 6.5.3 involves the Database Restore functionality not validating the content or file extension of uploaded files. An attacker can exploit this by uploading a malicious web shell file and then a .htaccess file to enable direct access to the web shell. This allows the attacker to execute remote code on the server.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to remote code execution on the server hosting ChurchCRM, which means an attacker could run arbitrary commands, potentially taking control of the server, accessing sensitive data, or disrupting services.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade ChurchCRM to version 6.5.3 or later, as this version fixes the vulnerability related to the Database Restore functionality allowing remote code execution via uploaded web shells and .htaccess files.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows attackers to gain full remote code execution on the server, leading to complete system compromise including unauthorized access, modification, or deletion of sensitive data such as user data, financial records, and audit logs. Such unauthorized access and potential data breaches can result in non-compliance with common standards and regulations like GDPR and HIPAA, which mandate protection of personal and sensitive information. Therefore, exploitation of this vulnerability poses a significant risk to compliance with these regulations. [1]

Useful 0 Not Useful 0

Detection Guidance

Detection of this vulnerability involves checking for the presence of uploaded web shell files and .htaccess files that enable access to them on the ChurchCRM server, especially if the version is prior to 6.5.3. You can scan the web server directories for suspicious files that are not typical database backups, such as files with web shell code or unexpected .htaccess files. Commands to help detect this include: 1) Searching for recently modified or uploaded files in the upload or backup directories, e.g., `find /path/to/churchcrm/uploads -type f -mtime -30` to find files modified in the last 30 days. 2) Grepping for common web shell signatures or suspicious PHP code, e.g., `grep -r --include=*.php 'eval(' /path/to/churchcrm/uploads` or `grep -r 'shell_exec' /path/to/churchcrm/uploads`. 3) Checking for .htaccess files that enable execution or access, e.g., `find /path/to/churchcrm/uploads -name '.htaccess' -exec cat {} \;`. 4) Reviewing web server logs for unusual access patterns to uploaded files that could indicate exploitation attempts. These steps can help identify if an attacker has uploaded malicious files exploiting the vulnerability. [1]

Useful 0 Not Useful 0