CyberRota Analysis
AI-GeneratedChurchCRM versions prior to 7.4.0 are vulnerable to Cross-Site Scripting (XSS) due to inadequate output encoding of user-controlled input, allowing attackers to inject malicious scripts into JavaScript and HTML contexts. This vulnerability can lead to severe consequences, including session-token theft, account takeover, and unauthorized actions, potentially compromising sensitive church member information. Organizations using affected versions should prioritize upgrading to version 7.4.0 to mitigate these risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
ChurchCRM is an open-source church management system. Prior to version 7.4.0, Cross-Site Scripting (XSS) vulnerabilities were identified due to insufficient output encoding of user-controlled request parameter names and parameter values. The application reflects attacker-controlled input into JavaScript string contexts and HTML attribute contexts without proper sanitization or contextual output encoding. Affected endpoints observed during testing: /FamilyCustomFieldsEditor.php, /PaddleNumList.php and /admin/system/church-info. Potential consequences include session-token theft, account takeover, unauthorized actions on behalf of authenticated users, exposure of sensitive church member information, credential harvesting, phishing, and privilege escalation when administrators are targeted. This issue has been resolved in version 7.4.0.