ChurchCRM
CVE-2025-67874
MEDIUM
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable with low complexity but needs a privileged account (PR:H) per the fix in admin system settings; password disclosure gives C:H with no integrity or availability impact.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
3DescriptionCVE.org
ChurchCRM is an open-source church management system. Prior to version 6.5.0, the application echoes back plaintext passwords submitted by users in subsequent HTTP responses. This information disclosure significantly increases the risk of credential compromise and may amplify the impact of other vulnerabilities (e.g., XSS, IDOR, session fixation), enabling attackers to harvest other users’ passwords. Version 6.5.0 fixes the issue.
AnalysisAI
ChurchCRM 6.5.0 and earlier reflect submitted plaintext passwords back into subsequent HTTP responses, and the confirmed instance in the vendor patch is the system-settings handler that re-displayed password-type default values to a privileged administrator. Reaching the flaw requires an authenticated high-privilege session (CVSS PR:H), and the impact is confidentiality-only, so real-world risk escalates mainly when the leaked response is captured through a companion XSS, IDOR, or session-fixation flaw; publicly available exploit code exists, there is no CISA KEV entry indicating confirmed active exploitation, and EPSS is low at 0.36% (27th percentile). Upgrading to 6.5.0 removes the exposure entirely.
Technical ContextAI
ChurchCRM is a self-hosted PHP church management application backed by MySQL/MariaDB and accessed through a web browser; the CPE string cpe:2.3:a:churchcrm:churchcrm:*:*:*:*:*:*:*:* with no version constraints identifies the product family as affected up to the fixed release. The assigned weakness class, CWE-204 (Observable Response Discrepancy), describes the root cause: the application's output layer fails to treat password-typed values as sensitive, so request-borne secrets are serialized back into the HTML of a later response instead of being suppressed. The vendor commit 2d6cf7aed9af1b9b47e125d1a2266f8e2a88f3fd confirms the mechanism in SystemSettings.php by wrapping the default-value rendering in a check that skips output when the setting's type is 'password'. That same commit also bundles unrelated hardening - replacing raw mysqli string-concatenated SQL with Propel ORM queries in EventEditor.php, FamilyCustomFieldsEditor.php, and PersonCustomFieldsEditor.php - addressing companion advisories GHSA-wxcc-gvfv-56fg and GHSA-47q3-c874-mqvp referenced in the code comments, which is why the 6.5.0 release note context matters when triaging this CVE alongside other ChurchCRM fixes. Because the leaked value originates from what an administrator types into a form and is redisplayed in a normal response body, the exposure surface is not just the browser: reverse proxies, TLS-terminating middleboxes, and access logs that record response bodies can also retain the plaintext password.
RemediationAI
The primary fix is a vendor-released patch: upgrade to ChurchCRM 6.5.0, which suppresses rendering of password-typed settings values (see the advisory at https://github.com/ChurchCRM/CRM/security/advisories/GHSA-p98h-5xcj-5c6x and the commit at https://github.com/ChurchCRM/CRM/commit/2d6cf7aed9af1b9b47e125d1a2266f8e2a88f3fd). If upgrade cannot be scheduled immediately, compensating controls should target the fact that a high-privilege authenticated session is the prerequisite: restrict access to administrative endpoints such as SystemSettings.php to trusted management networks or VPN (trade-off: breaks remote administration from untrusted networks), and audit or temporarily disable any settings page that re-displays stored password defaults (trade-off: administrators lose convenience defaults and may re-enter credentials more often). Because the leak puts plaintext secrets into response bodies and potentially into proxy or access logs, rotate any credentials that were entered or displayed on the affected settings pages, and consider trimming response-body logging on the web tier - noting that disabling body logging reduces forensic visibility for other incidents. Finally, since the flaw is only materially dangerous when chained with an XSS, IDOR, or session-fixation issue that lets an attacker read another user's response, prioritize patching those companion classes and enforce Content-Security-Policy plus SameSite/Secure cookie attributes to shrink that chain, accepting the usual compatibility risk CSP imposes on legacy inline scripts.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-204 – Observable Response Discrepancy
View allShare
External POC / Exploit Code
Leaving vuln.today