An authenticated administrator can exploit ChurchCRM’s database restore feature to upload a specially crafted backup archive containing a PHP file. The restoration process copies the archive’s Images/ directory into the web‑accessible document root without filtering file extensions, enabling a PHP web shell to be written and later executed by the web server. The flaw also lacks CSRF protection, allowing attackers to trigger the exploit via a forged request. This combination of unrestricted file write and elevation to the web server’s execution context leads to remote code execution and full compromise under the web server’s user privileges. The weakness is reflected by CWE‑434 (Unrestricted Upload of File with Dangerous Type), CWE‑552 (Unrestricted File Transfer) and CWE‑269 (Improper Privilege Management).

The vulnerability exists in all ChurchCRM Community Edition installations running any version prior to 7.2.0. The affected product is the ChurchCRM web application, version 7.1.x and earlier.

The issue carries a CVSS base score of 9.1, indicating critical severity. No EPSS score is available, and it is not listed in CISA’s KEV catalog. Exploitation requires the attacker to have access to an authenticated administrator account, but CSRF can be used to abuse that privilege without the admin’s direct interaction. Once executed, the attacker gains arbitrary code execution on the host as the web server user, allowing full system compromise, data exfiltration, and persistence.