Session Hijacking via Reflected Cross-Site Scripting (XSS) in ChurchCRM EditEventAttendees.php EID Parameter

Successful exploitation of this XSS vulnerability allows an attacker to inject malicious JavaScript code into the ChurchCRM application. This code can then be executed in the context of an authenticated user's browser, potentially allowing the attacker to steal session cookies, perform actions on behalf of the user, and gain unauthorized access to sensitive data. The impact can range from defacement of the application to complete account takeover, depending on the attacker's objectives and the privileges of the targeted user. The blast radius extends to all users with administrative privileges.

Organizations utilizing ChurchCRM, particularly those with administrative users who may be targeted by social engineering attacks, are at risk. Shared hosting environments where multiple ChurchCRM instances reside on the same server could potentially expose multiple organizations to this vulnerability if one instance is compromised.

• php: Examine access logs for suspicious requests to EditEventAttendees.php containing unusual characters or JavaScript code in the EID parameter. Look for patterns like <script> or javascript:.

grep -i 'script|javascript' /var/log/apache2/access.log | grep EditEventAttendees.php

• generic web: Use curl to test the EditEventAttendees.php endpoint with a simple XSS payload (e.g., <script>alert('XSS')</script>) in the EID parameter and observe the response for signs of script execution.

curl 'http://your-churchcrm-instance/EditEventAttendees.php?EID=<script>alert("XSS")</script>' -s

1. 2025-02-19Disclosure

   disclosure

1. Reserviert2025-02-04
2. Veröffentlicht2025-02-19
3. EPSS aktualisiert2026-04-02

The recommended mitigation is to upgrade ChurchCRM to version 5.13.1 or later, which includes the fix for this vulnerability. As a temporary workaround, implement strict input validation and sanitization on all user-supplied data, particularly the EID parameter in the EditEventAttendees.php page. Consider using a Content Security Policy (CSP) to restrict the execution of inline scripts and limit the potential impact of XSS attacks. After upgrading, verify the fix by attempting to inject a simple JavaScript payload and confirming that it is properly sanitized.