ChurchCRM hat Stored XSS im Gruppennamen

The impact of this XSS vulnerability is significant, as it allows an attacker to execute arbitrary JavaScript code within the context of an administrator's session. This can be exploited to steal session cookies, effectively granting the attacker full administrative access to the ChurchCRM system. An attacker could then modify church records, access sensitive member data, or even compromise the entire system. The stored nature of the XSS means the malicious script persists until removed, potentially affecting multiple administrators over time. This vulnerability shares similarities with other XSS attacks where session hijacking is the primary goal, allowing for persistent compromise.

Churches and religious organizations using ChurchCRM versions 6.5.0 through 6.5.2 are at direct risk. Organizations with limited IT security resources or those relying on shared hosting environments are particularly vulnerable, as they may be slower to apply security updates. Administrators with group-creation privileges are the most immediate targets.

• php: Examine ChurchCRM logs for suspicious POST requests to the group creation endpoint containing JavaScript payloads. Use grep to search for patterns like <script> or alert() within these logs. • generic web: Monitor access logs for requests to the group creation endpoint with unusual user agents or referrer headers. • generic web: Use curl to test the group creation endpoint with a simple XSS payload and observe the response for signs of script execution (e.g., an alert box).

curl -X POST -d 'group_name=<script>alert("XSS")</script>' http://churchcrm/admin/group_create.php

1. 2026-04-07Disclosure

   disclosure

1. Reserviert2026-04-03
2. Veröffentlicht2026-04-07
3. EPSS aktualisiert2026-04-15

The primary mitigation for CVE-2026-35575 is to immediately upgrade ChurchCRM to version 6.5.3 or later, which contains the fix. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to block suspicious JavaScript injection attempts in the group-creation form. Carefully review and sanitize all user input, particularly when dealing with administrative functions. Regularly audit user roles and permissions to ensure that only authorized personnel have group-creation privileges. After upgrading, confirm the fix by attempting to create a group with a simple JavaScript payload (e.g., <script>alert('XSS')</script>) and verifying that the script does not execute.