Attack Chain

1. Attacker gains valid administrator credentials to the ChurchCRM application.
2. Attacker crafts a malicious backup archive containing a PHP webshell file (e.g., shell.php) within an Images/ directory structure.
3. The attacker uploads the crafted backup archive through the ChurchCRM administrative interface using the database backup restore functionality.
4. The application's recursiveCopyDirectory() function extracts the archive contents without proper file extension filtering.
5. The PHP webshell file (e.g., shell.php) is copied from the Images/ directory within the archive to a publicly accessible directory in the web server's document root.
6. The attacker leverages the lack of CSRF protection in the restore endpoint, possibly by tricking an administrator into triggering the restore via a malicious link or website.
7. The attacker sends an HTTP request to the uploaded PHP webshell (e.g., http://churchcrm.example.com/Images/shell.php?cmd=whoami) to execute arbitrary code on the server.
8. The web server executes the PHP code, granting the attacker remote code execution capabilities as the web server user.

Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code on the ChurchCRM server with the privileges of the web server user. This could lead to complete compromise of the server, data exfiltration (including sensitive church member data), defacement of the website, or further lateral movement within the network. Given the sensitive nature of data typically stored in church management systems, the impact can be severe.

Recommendation

• Upgrade ChurchCRM to version 7.2.0 or later to patch CVE-2026-40484 immediately.
• Implement a web application firewall (WAF) rule to detect and block requests to potentially malicious PHP files uploaded to the Images/ directory, specifically targeting HTTP requests with suspicious parameters like cmd=.
• Deploy the Sigma rule detecting suspicious PHP file creation in web directories to identify potential webshell uploads.
• Enable logging for web server access and error logs and monitor for unusual activity, especially related to the Images/ directory.