PT-2025-51867 · Churchcrm · Churchcrm

Uartu0

·

Published

2025-12-17

·

Updated

2026-04-07

·

CVE-2025-62521

CVSS v3.1

10

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions ChurchCRM versions prior to 5.21.0
Description ChurchCRM is an open-source church management system. Prior to version 5.21.0, a pre-authentication remote code execution issue exists in the setup wizard. Unauthenticated attackers can inject arbitrary PHP code during the initial installation process, potentially leading to complete server compromise. The issue is located in setup/routes/setup.php, where user input from the setup form is directly concatenated into a PHP configuration template without validation or sanitization. Any parameter in the setup form can be used to inject PHP code that is written to Include/Config.php and subsequently executed on every page load. The vulnerability is more severe than typical authenticated remote code execution issues because it requires no credentials and affects the installation process.
Recommendations Versions prior to 5.21.0 should be updated to version 5.21.0 or later.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2025-62521
GHSA-M8JQ-J3P9-2XF3

Affected Products

Churchcrm