PT-2025-51927 · Churchcrm · Churchcrm

Saadet-T · Published 2025-12-17 · Updated 2025-12-20 · CVE-2025-68109

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ChurchCRM versions prior to 6.5.3

Description ChurchCRM is an open-source church management system. The Database Restore functionality does not validate the content or file extension of uploaded files. This allows an attacker to upload a web shell file and subsequently upload a .htaccess file to enable direct access to it. Once accessed, the uploaded web shell allows remote code execution (RCE) on the server. The Database Restore functionality is the affected component.

Recommendations Update ChurchCRM to version 6.5.3 to resolve this issue.

Exploit

Fix

RCE

Files Accessible to External Parties

Unrestricted File Upload

OS Command Injection

Weakness Enumeration

CWE-494

CWE-915

CWE-552

CWE-434

CWE-78

Related Identifiers

CVE-2025-68109

GHSA-PQM7-G8PX-9R77

Affected Products

Churchcrm

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68109.json · Exploit
• https://github.com/ChurchCRM/CRM/security/advisories/GHSA-pqm7-g8px-9r77 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-68109 · Security Note
• https://osv.dev/vulnerability/CVE-2025-68109 · Vendor Advisory
• https://twitter.com/TheHackerWire/status/2001421543059132784 · Twitter Post
• https://t.me/cveNotify/146237 · Telegram Post
• https://twitter.com/CveFindCom/status/2001422013257154751 · Twitter Post
• https://twitter.com/CVEnew/status/2002487819164659769 · Twitter Post
• https://twitter.com/0dayPublishing/status/2001407175864795446 · Twitter Post