BaseFortify

Executive Summary

This vulnerability is a Stored Cross-Site Scripting (XSS) issue in ChurchCRM versions prior to 6.5.4. It occurs in the GroupEditor.php page, where a user with permission to view and modify groups can create a group role that includes malicious JavaScript code. This code is then stored and can be executed by other users, potentially compromising their security. The issue was fixed in version 6.5.4.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability allows an attacker with certain permissions to inject malicious JavaScript into the application, which can then execute in the browsers of other users who view the affected group roles. This can lead to unauthorized actions, data theft, or session hijacking for those users. However, exploitation requires the attacker to have permission to view and modify groups.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate step to mitigate this vulnerability is to upgrade ChurchCRM to version 6.5.4 or later, as this version fixes the Stored Cross-Site Scripting (XSS) vulnerability in the GroupEditor.php page.

Useful 0 Not Useful 0

Compliance Impact

The provided resources do not specify how this vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by attempting to inject a known XSS payload into the 'Add New Role' functionality on the GroupEditor.php page of ChurchCRM versions prior to 6.5.4. For example, submitting a role name with the payload `"><img src=x onerror=alert(1)>` via a POST request to `/crm/api/groups/<GROUP_ID>/roles` can trigger the vulnerability if the alert box appears upon page reload. To detect this on your system, you can use curl or similar tools to simulate the POST request with the payload. Example command: `curl -X POST -d 'roleName="><img src=x onerror=alert(1)>' https://yourchurchcrminstance/crm/api/groups/<GROUP_ID>/roles -b cookies.txt -c cookies.txt` (assuming authentication cookies are managed). Monitoring for unexpected JavaScript execution or alert pop-ups when viewing group roles can also indicate the presence of the vulnerability. [1]

Useful 0 Not Useful 0