Cross-Site Scripting in ChurchCRM Prior to 7.4.0

Executive Summary

CVE-2026-58411 is a Cross-Site Scripting (XSS) vulnerability in ChurchCRM, an open-source church management system. The vulnerability exists because the application does not properly encode or sanitize user-controlled input in request parameter names and values before reflecting them in JavaScript string contexts and HTML attribute contexts.

This means an attacker can craft malicious requests containing scripts or malicious payloads in parameter names or values. When these inputs are reflected in the application's output without proper sanitization, the scripts execute in the context of a victim's browser. This can lead to unauthorized actions or data exposure.

• Affected endpoints include /FamilyCustomFieldsEditor.php, /PaddleNumList.php, and /admin/system/church-info.

The issue was fixed in ChurchCRM version 7.4.0, where proper output encoding was implemented to prevent XSS attacks.

Useful 0 Not Useful 0

Detection Guidance

Detecting this Cross-Site Scripting (XSS) vulnerability in ChurchCRM requires checking if your system is running a vulnerable version (prior to 7.4.0) and testing for improper output encoding in specific endpoints.

• Check the installed version of ChurchCRM. If it is below 7.4.0, the system is vulnerable. You can typically find the version in the application's admin dashboard or by inspecting the source code or configuration files.
• Test the affected endpoints for XSS vulnerabilities by sending crafted requests with malicious payloads in parameter names or values. For example, you can use tools like curl or browser developer tools to inject simple XSS payloads (e.g., <script>alert(1)</script>) into the following endpoints:
• - /FamilyCustomFieldsEditor.php
• - /PaddleNumList.php
• - /admin/system/church-info
• If the payload executes (e.g., an alert popup appears), the system is vulnerable to XSS.
• Use automated vulnerability scanners like OWASP ZAP or Burp Suite to scan for XSS vulnerabilities in the application. These tools can automate the process of sending payloads and detecting reflections.
• Inspect the application's source code for proper output encoding. Look for functions that sanitize or encode user-controlled input before reflecting it in JavaScript or HTML contexts. Missing or improper encoding indicates a vulnerability.

Useful 0 Not Useful 0

Impact Analysis

If you are using an affected version of ChurchCRM (prior to 7.4.0), this vulnerability could have several serious impacts:

• Session-token theft: An attacker could steal session cookies, allowing them to hijack user sessions.
• Account takeover: Attackers could gain control of user accounts, including those with administrative privileges.
• Unauthorized actions: Attackers could perform actions on behalf of authenticated users, such as modifying or deleting sensitive data.
• Exposure of sensitive information: Church member data, including personal and financial details, could be accessed or exfiltrated.
• Credential harvesting: Attackers could trick users into submitting their credentials on fake login pages.
• Phishing attacks: Malicious scripts could redirect users to phishing sites or display fake forms to collect sensitive information.
• Privilege escalation: If administrators are targeted, attackers could gain elevated access to the system, leading to further compromise.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability can have significant implications for compliance with data protection and privacy regulations:

• GDPR (General Data Protection Regulation): If ChurchCRM is used to store or process personal data of EU citizens, this vulnerability could lead to unauthorized access or exposure of that data. GDPR requires organizations to implement appropriate security measures to protect personal data. A successful XSS attack could result in a data breach, triggering reporting obligations and potential fines under GDPR.
• HIPAA (Health Insurance Portability and Accountability Act): If ChurchCRM is used in a healthcare context to manage patient or member health information, this vulnerability could lead to unauthorized access to protected health information (PHI). HIPAA requires safeguards to ensure the confidentiality, integrity, and availability of PHI. A breach resulting from this vulnerability could lead to non-compliance and penalties.
• Other standards: Compliance with frameworks like ISO 27001, NIST, or PCI DSS may also be affected if the vulnerability leads to unauthorized access or data exposure. These standards require organizations to implement controls to mitigate risks like XSS.

Organizations using affected versions of ChurchCRM should update to version 7.4.0 or later to mitigate this risk and ensure compliance with applicable regulations.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, follow these immediate steps:

• Upgrade ChurchCRM to version 7.4.0 or later, as this version resolves the XSS vulnerabilities by implementing proper output encoding.
• If upgrading is not immediately possible, apply temporary mitigations such as:
• - Restrict access to the affected endpoints (/FamilyCustomFieldsEditor.php, /PaddleNumList.php, and /admin/system/church-info) to trusted users only.
• - Implement a Web Application Firewall (WAF) to filter out malicious XSS payloads. Configure the WAF to block requests containing suspicious characters or patterns commonly used in XSS attacks.
• - Manually review and sanitize user-controlled input in the affected endpoints. Ensure that all output is properly encoded for the appropriate context (e.g., HTML, JavaScript, or HTML attributes).
• Monitor the application for suspicious activity, such as unexpected script executions or unauthorized access attempts. Log and review requests to the affected endpoints for signs of exploitation.
• Educate users and administrators about the risks of XSS attacks and the importance of avoiding untrusted links or inputs.

Useful 0 Not Useful 0