Fix ChurchCRM unauthenticated RCE module

[Chocapikk]

Summary

Refactors the churchcrm_install_unauth_rce module with reliability and code quality fixes. All three targets (CmdStager, PHP In-Memory, PHP Fetch) tested and producing sessions against ChurchCRM 6.8.0.

Changes

Metadata

• Rank upgraded from NormalRanking to ExcellentRanking (reliable, no crash risk)
• Prepend AutoCheck to auto-run check before exploit
• Add vulnerability discoverer Arthur Valverde (uartu0) to authors
• Fix GHSA reference format: ['GHSA', 'm8jq-j3p9-2xf3', 'ChurchCRM/CRM']
• Improve module name and description, noting the bogus 5.21.0 "fix" (strlen check only)

Cleanup strategy

• Remove InitialAutoRunScript from all targets - it was unreliable because it ran a shell command via meterpreter to delete Config.php, which could fail silently
• PHP targets: inject unlink(__FILE__) directly into the PHP payload prefix, so Config.php deletes itself during execution (file already loaded in memory)
• CmdStager target: send rm -f Include/Config.php as a final command after staging completes

Code quality

• Extract setup_uri helper (trailing slash required for 200 response with CRM-VERSION header)
• Randomize DB_SERVER_PORT and GET parameter name (@cmd_param) to reduce fingerprinting
• Use short randomized PHP variable for fetch payload to reduce size
• Simplify check method with early returns instead of nested if/else
• Factor build_config_payload to DRY up common prefix/suffix across targets
• Remove redundant register_options (TARGETURI already provided by HttpClient)
• Remove unnecessary headers from on_request_uri response

Documentation

• Add GHSA reference examples (global and repository-scoped) to the code sample in Module-Reference-Identifiers.md

Test plan

• Target 1 (CmdStager) - linux/x64/meterpreter/reverse_tcp - session obtained
• Target 2 (PHP In-Memory) - php/meterpreter/reverse_tcp - session obtained
• Target 3 (PHP Fetch) - php/meterpreter/reverse_tcp - session obtained
• check returns Appears with version on vulnerable target
• Config.php cleaned up after exploitation on all targets

[msutovsky-r7]

Is this part of update?

[Chocapikk]

Yes, I can do a different PR if this is an issue, but I updated the example because apparently the GHSA format wasn't clear; there are two formats.

[Copilot]

Pull request overview

This PR refactors the churchcrm_install_unauth_rce Metasploit module, improving reliability, code quality, and cleanup strategies for exploiting ChurchCRM <= 6.8.0 unauthenticated RCE via PHP code injection in the setup page's DB_PASSWORD field.

Changes:

• Replaces unreliable InitialAutoRunScript-based cleanup with inline unlink(__FILE__) for PHP targets and a direct rm -f command for the CmdStager target, upgrades rank to ExcellentRanking, and adds AutoCheck.
• Refactors the module code: extracts setup_uri helper, DRYs up payload building via build_config_payload, simplifies the check method with early returns, and randomizes the GET parameter name and DB_SERVER_PORT.
• Updates Module-Reference-Identifiers.md documentation to add GHSA examples (global and repository-scoped) and reformats the reference table.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
modules/exploits/multi/http/churchcrm_install_unauth_rce.rb	Refactored exploit module with improved cleanup, code quality, metadata, and reduced fingerprinting
docs/metasploit-framework.wiki/Module-Reference-Identifiers.md	Reformatted reference table, added GHSA (with repo scope), OSV, and ATT&CK reference examples

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

[adfoster-r7]

## Release Notes

Adds multiple improvements to the multi/http/churchcrm_install_unauth_rce module