Horizon Alert
Summary of the vulnerability and why it matters
An administrator in ChurchCRM can upload a malicious backup file to execute arbitrary code. This occurs because the system improperly handles archive contents during the restore process, allowing a PHP webshell to be placed in a publicly accessible location and run. The lack of cross-site request forgery protection further increases the risk.
- Allows remote code execution.
- Affects authenticated administrators.
- Can be exploited via the internet.
Attack Path
How an attacker could exploit the issue
An attacker can exploit this by crafting a backup archive containing a PHP webshell within the `Images/` directory, then tricking an authenticated administrator into restoring it. The application will then copy the webshell to the web-accessible document root, allowing the attacker to execute code as the web server user via a simple HTTP request.
- Authenticated administrator needed.
- Restore functionality is the target.
- No CSRF validation.
Live Threat
Current exploitation, exposure, and threat context
Attackers will likely find this vulnerability appealing due to its critical severity and ability to achieve remote code execution. The combination of unrestricted file uploads within an archive and a lack of CSRF protection presents a straightforward path for attackers to compromise the system. However, its reliance on authenticated administrator access may limit its widespread applicability compared to vulnerabilities exploitable by unauthenticated users.
- Exploited by authenticated admin.
- Remote code execution possible.
- CSRF vector increases risk.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Prioritize patching ChurchCRM instances to version 7.2.0 to address the critical remote code execution vulnerability. If immediate patching is not feasible, isolate affected systems from the network or restrict administrative access to prevent exploitation via the backup restore functionality and cross-site request forgery. Monitor for any signs of unauthorized access or unusual file creation within the web root.
- Patch to version 7.2.0.
- Isolate affected instances.
- Monitor for webshells.
