PHP CVE-2026-40484

Requires authenticated access with administrator-level privileges to the ChurchCRM application. The attacker must have valid credentials for an account with permissions to access the database backup restore functionality, or successfully execute a CSRF attack against a currently authenticated administrator. No additional non-default configuration or specific feature enablement is required beyond standard ChurchCRM installation with the backup/restore feature accessible. The web server must allow PHP execution in the document root's Images/ directory (default configuration in most PHP web server deployments). Exploitation is limited by the need for high-privilege access, but the CSRF vector reduces this limitation by enabling forced exploitation through social engineering. The vulnerability affects default configurations of ChurchCRM versions prior to 7.2.0.

Real-world risk is moderate despite the 9.1 CVSS score. The CVSS vector (AV:N/AC:L/PR:H/UI:N/S:C) indicates network accessibility with low complexity, but requires high privileges (administrator authentication), which significantly constrains the attack surface. The Changed scope (S:C) reflects impact beyond the vulnerable component itself. No EPSS data provided, but the narrow attack surface (admin-only access) suggests lower probability of mass exploitation. Not present in CISA KEV, indicating no confirmed active exploitation at time of analysis. The CSRF component (UI:N in vector contradicts the CSRF requirement - this discrepancy suggests the vector may represent the primary webshell upload path rather than the CSRF variant) moderately increases risk by enabling social engineering attacks. Publicly available patch in version 7.2.0 with specific GitHub commit (68be1d12) reduces urgency for organizations with active patch management. Primary risk is to Internet-facing ChurchCRM installations where administrator accounts may be compromised through credential reuse, phishing, or session hijacking. Organizations with defense-in-depth controls (WAF, file upload restrictions, PHP execution blocking in upload directories) have reduced exposure.

An attacker who has compromised an administrator account (through credential stuffing, phishing, or session hijacking) creates a malicious ChurchCRM backup archive containing a PHP webshell placed within the Images/ directory structure. The attacker authenticates to ChurchCRM, navigates to the database restore function, and uploads the crafted archive. The recursiveCopyDirectory() function extracts and copies the webshell to a predictable web-accessible path such as /Images/shell.php. The attacker then issues HTTP requests directly to the webshell URL, achieving arbitrary command execution as the web server user to exfiltrate database contents, modify records, or pivot to internal network resources. Alternatively, an attacker uses CSRF to trick an authenticated administrator into visiting a malicious page that silently submits the restore request with the weaponized archive, achieving exploitation without directly compromising admin credentials.