CVE-2025-11938
📋 TL;DR
A deserialization vulnerability in ChurchCRM's setup.php file allows remote attackers to potentially execute arbitrary code by manipulating DB_PASSWORD, ROOT_PATH, or URL parameters. This affects ChurchCRM installations up to version 5.18.0 that have the setup interface accessible. The exploit complexity is high but public exploit code exists.
💻 Affected Systems
- ChurchCRM
📦 What is this software?
Churchcrm by Churchcrm
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, and lateral movement within the network.
Likely Case
Unauthorized access to the database, configuration file exposure, and potential privilege escalation within the ChurchCRM application.
If Mitigated
Limited impact if setup interface is properly restricted or removed, with potential information disclosure at most.
🎯 Exploit Status
Exploit code is publicly available in GitHub advisory. Attack complexity is rated high but exploitability is documented.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.19.0 or later
Vendor Advisory: https://github.com/ChurchCRM/CRM/releases
Restart Required: No
Instructions:
1. Backup your ChurchCRM installation and database. 2. Download the latest version from the official GitHub repository. 3. Replace the affected files, particularly setup/routes/setup.php. 4. Verify the installation works correctly.
🔧 Temporary Workarounds
Remove Setup Interface
allDelete or restrict access to the setup directory after initial installation
rm -rf /path/to/churchcrm/setup/
chmod 000 /path/to/churchcrm/setup/
Web Server Access Control
allConfigure web server to block access to setup directory
# Apache: Add to .htaccess
Deny from all
# Nginx: Add to server block
location /setup/ { deny all; }
🧯 If You Can't Patch
- Implement strict network segmentation to isolate ChurchCRM from critical systems
- Deploy web application firewall (WAF) with deserialization attack detection rules
🔍 How to Verify
Check if Vulnerable:
Check if setup directory exists and is accessible via web browser at /setup/Check Version:
grep 'Version' /path/to/churchcrm/ChurchCRM/includes/Config.phpVerify Fix Applied:
Verify ChurchCRM version is 5.19.0 or later and setup directory is not accessible📡 Detection & Monitoring
Log Indicators:
- Unusual requests to setup.php with manipulated parameters
- Deserialization errors in application logs
- Unexpected process execution from web server user
Network Indicators:
- HTTP requests containing serialized objects in parameters
- Traffic to setup.php with DB_PASSWORD, ROOT_PATH, or URL parameters
SIEM Query:
source="web_access" AND uri="/setup/routes/setup.php" AND (param="DB_PASSWORD" OR param="ROOT_PATH" OR param="URL")