ChurchCRM Affected by Unauthenticated RCE in Install Wizard
Résumé
ChurchCRM Affected by Unauthenticated RCE in Install Wizard
Description d'origine
La description telle que publiée par la source (souvent en anglais).
ChurchCRM is an open-source church management system. Prior to 7.1.0, critical pre-authentication remote code execution vulnerability in ChurchCRM's setup wizard allows unauthenticated attackers to inject arbitrary PHP code during the initial installation process, leading to complete server compromise. The "$dbPassword" variable is not sanitized. This vulnerability exists due to an incomplete fix for CVE-2025-62521. This vulnerability is fixed in 7.1.0.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov