PT-2022-11808 · Unknown · Churchinfo

M4Lwhere · Published 2022-11-23 · Updated 2025-04-28 · CVE-2021-43258

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ChurchInfo version 1.3.0

Description The issue allows attackers to achieve remote code execution through insecure uploads in the ChurchInfo application. This requires authenticated access to the application. Once authenticated, a user can upload attachments for emails without any limitations on file types, allowing for malicious PHP code to be uploaded and interpreted by the server.

Recommendations For ChurchInfo version 1.3.0, consider restricting access to the /tmp attach/ folder to prevent direct access to uploaded files, and implement file type validation to prevent uploading of malicious PHP code. As a temporary workaround, consider disabling the file upload feature for email attachments until a patch is available.

Exploit

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2021-43258

Affected Products

Churchinfo

References · 7

• 🔥 https://github.com/rapid7/metasploit-framework/pull/17257 · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/churchinfo_upload_exec.rb · Exploit
• https://osv.dev/vulnerability/CVE-2021-43258 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-43258 · Security Note
• http://churchdb.org · Note
• https://sourceforge.net/projects/churchinfo/files · Note
• https://t.me/cvenotify/120106 · Telegram Post