PT-2025-51870 · Churchcrm · Churchcrm

Vesp3Rtine · Publicado 2025-12-17 · Atualizado 2025-12-21 · CVE-2025-66397

Positive Technologies (AI Summary)

CVSS v3.1

8.3

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H

Name of the Vulnerable Software and Affected Versions ChurchCRM versions prior to 6.5.3

Description ChurchCRM, an open-source church management system, has an issue with access control in the Kiosk Manager feature. Specifically, the allowRegistration, acceptKiosk, reloadKiosk, and identifyKiosk functions are affected. Any authenticated user can perform actions such as allowing and accepting kiosk registrations, reloading, and identifying kiosks.

Recommendations Update to version 6.5.3 or later.

Exploit

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

CVE-2025-66397

GHSA-32VR-CH3P-WMR5

Produtos afetados

Churchcrm

Referências · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66397.json · Exploit
• https://github.com/ChurchCRM/CRM/security/advisories/GHSA-32vr-ch3p-wmr5 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2025-66397 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2025-66397 · Aviso do Fabricante
• https://twitter.com/TheHackerWire/status/2001397846764130737 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2002835978738688362 · Publicação no Twitter