ChurchCRM is an open-source church management system. Prior to 6.5.3, a path traversal vulnerability in ChurchCRM's backup restore functionality allows authenticated administrators to upload arbitrary files and achieve remote code execution by overwriting Apache .htaccess configuration files. The vulnerability exists in src/ChurchCRM/Backup/RestoreJob.php. The $rawUploadedFile['name'] parameter is user-controlled and allows uploading files with arbitrary names to /var/www/html/tmp_attach/ChurchCRMBackups/. This vulnerability is fixed in 6.5.3.
The vulnerability is located in the file src/ChurchCRM/Backup/RestoreJob.php, where the parameter $rawUploadedFile['name'] is fully controlled by the user. Lack of proper file name validation allows an attacker to upload a file with any path to the /var/www/html/tmp_attach/ChurchCRMBackups/ directory. Through path traversal sequences, it is possible to overwrite the Apache .htaccess file, which leads to server configuration modification and ultimately to remote code execution.
An attacker with administrator privileges can gain full control of the server through remote code execution (RCE), and can also compromise the confidentiality, integrity, and availability of the system.
ChurchCRM should be updated to version 6.5.3 or later, in which the vulnerability has been fixed. According to manufacturer references, it is available directly in the project's GitHub repository.
ChurchCRM in all versions prior to 6.5.3
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:HChurchcrm
APPChurchcrm< 6.5.3
Related vulnerabilities
SQL Injection w ChurchCRM przez parametr searchwhat (QueryView.php)
ChurchCRM — krytyczny auth bypass w API middleware
ChurchCRM: pre-auth RCE przez wstrzyknięcie kodu PHP w kreatorze instalacji
ChurchCRM: ujawnienie danych logowania do bazy danych w komunikacie błędu
Stored XSS w ChurchCRM — przejęcie konta przez nazwy ról grup