Critical · published December 18, 2025
🚨 A web shell uploaded via an unchecked file upload — this is a critical flaw in ChurchCRM that can lead to a full-blown server takeover! 🔥 Think of it like a restaurant where anyone can drop off a bag of ingredients without any checks — a malicious chef could slip in something nasty, then whip up a disaster in the kitchen. 🍴 With this vulnerability, an attacker can upload a web shell, gaining access to execute any command on your server. This means they could steal sensitive data, modify your system, or even bring your entire application to its knees. The consequences could be absolutely devastating for your church's operations!
Think of it like a restaurant where anyone can drop off a bag of ingredients without any checks — a malicious chef could slip in something nasty, then whip up a disaster in the kitchen. 🍴 The vulnerability in ChurchCRM allows attackers to upload files without validating their content or file extensions, enabling the upload of a .htaccess file. This file grants direct access to a malicious web shell, leading to remote code execution on the server.
With this vulnerability, an attacker can upload a web shell, gaining access to execute any command on your server. This means they could steal sensitive data, modify your system, or even bring your entire application to its knees. The consequences could be absolutely devastating for your church's operations! Immediately upgrade to ChurchCRM version 6.5.3 to patch this vulnerability. Additionally, implement strict file validation protocols to ensure only safe file types can be uploaded. Conduct a review of your upload functionality for any other potential weaknesses. You've got this! By following these steps, you can fortify your security and keep your church's data safe! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| churchcrm/churchcrm | < 6.5.3 | 6.5.3 |