ChurchInfo Arbitrary File Upload Vulnerability

ChurchInfo is a free church database program from the ChurchInfo team that helps churches track members, families, groups, pledges, and payments. ChurchInfo 1.2.13 and later, and 1.3.0 and prior versions, is vulnerable to arbitrary file uploads. The vulnerability stems from the application’s lack of checks on uploaded files, which can be exploited by attackers to upload malicious PHP files and execute arbitrary code.