CVE-2025-62521
CriticalSummary
ChurchCRM before version 5.21.0 contains a pre-authentication remote code execution vulnerability in the setup wizard. An unauthenticated attacker can inject arbitrary PHP code during the installation process, leading to complete server compromise. The issue arises from directly concatenating user input from the setup form into a PHP configuration template without validation.
Risk Assessment
An attacker without any credentials can take over the server, potentially leading to data theft, system integrity compromise, and service disruption.
Recommendation
Immediately upgrade ChurchCRM to version 5.21.0 or later, which includes the fix. Also check if the installation has already been compromised.
Original NVD description (English source)
ChurchCRM is an open-source church management system. Prior to version 5.21.0, a pre-authentication remote code execution vulnerability in ChurchCRM's setup wizard allows unauthenticated attackers to inject arbitrary PHP code during the initial installation process, leading to complete server compromise. The vulnerability exists in `setup/routes/setup.php` where user input from the setup form is directly concatenated into a PHP configuration template without any validation or sanitization. Any parameter in the setup form can be used to inject PHP code that gets written to `Include/Config.php`, which is then executed on every page load. This is more severe than typical authenticated RCE vulnerabilities because it requires no credentials and affects the installation process that administrators must complete. Version 5.21.0 patches the issue.