ChurchCRM Pre-Authentication Remote Code Execution Vulnerability in Setup Wizard

A pre-authentication remote code execution vulnerability exists in ChurchCRM versions prior to 7.3.2. The issue arises in the setup wizard, where the 'DB_PASSWORD' field is not properly sanitized. This vulnerability allows an attacker to execute arbitrary operating system commands by injecting a payload into the 'DB_PASSWORD' field, which is then processed by the application.

Impact

Exploitation of this vulnerability allows for full server compromise, with executed commands running as the 'www-data' user.

Reproduction

The vulnerability can be reproduced by accessing the ChurchCRM setup wizard without authentication. After injecting a payload into the 'DB_PASSWORD' field, the 'Config.php' file is loaded, executing the injected command. This can be automated with a Python script that interacts with the setup wizard and captures the output of the executed commands.

Remediation

Users are advised to update to ChurchCRM version 7.3.2 or later.