Critical · published December 17, 2025
🚨 A tiny oversight during setup can open the floodgates to disaster! Before version 5.21.0, ChurchCRM allows unauthenticated attackers to execute remote code with just a clever twist during installation. 🔥 Picture this: you're setting up a new restaurant, and the contractor lets anyone write the menu without checking! If someone sneaks in a recipe for disaster, it could ruin the whole kitchen. That's exactly what happens here when user input is mishandled during ChurchCRM's setup process. An attacker could exploit this vulnerability to inject arbitrary PHP code, leading to complete server compromise — think of a thief walking straight into the vault because the door was left wide open! This could result in unauthorized access to sensitive data, manipulation of server files, and even complete control over the server itself. Absolutely devastating!
Picture this: you're setting up a new restaurant, and the contractor lets anyone write the menu without checking! If someone sneaks in a recipe for disaster, it could ruin the whole kitchen. That's exactly what happens here when user input is mishandled during ChurchCRM's setup process. This vulnerability exists in `setup/routes/setup.php`, where user inputs are directly concatenated into a PHP configuration template without any validation or sanitization. This means any parameter in the setup form can become executable PHP code, compromising the server upon every page load.
An attacker could exploit this vulnerability to inject arbitrary PHP code, leading to complete server compromise — think of a thief walking straight into the vault because the door was left wide open! This could result in unauthorized access to sensitive data, manipulation of server files, and even complete control over the server itself. Absolutely devastating! To protect your installation, immediately upgrade to ChurchCRM version 5.21.0 or later. If you’ve already set up ChurchCRM, consider reviewing your configurations and ensure that unauthorized access controls are in place. Regularly audit your setup processes for security flaws! You've got this! By taking these steps, you'll secure your system and be a true security hero! 🛡️