Platform
php
Component
cveproject
Fixed in
1.0.1
A problematic cross-site scripting (XSS) vulnerability has been identified in SourceCodester Best Church Management Software versions 1.0 through 1.0. This flaw allows attackers to inject malicious scripts into the application, potentially leading to session hijacking or defacement. The vulnerability resides within the /admin/redirect.php file and can be exploited remotely. A fix is available in version 1.0.1.
Successful exploitation of CVE-2025-1597 enables an attacker to inject arbitrary JavaScript code into the Best Church Management Software application. This can be leveraged to steal user credentials, redirect users to malicious websites, or modify the application's behavior. The impact is particularly severe for administrative users, as their accounts could be compromised, granting the attacker full control over the church management system. The remote nature of the vulnerability means it can be exploited from anywhere with network access to the affected system. While the CVSS score is LOW, the potential for data theft and system compromise warrants immediate attention.
This vulnerability has been publicly disclosed, increasing the risk of exploitation. No KEV listing or EPSS score is currently available. Public proof-of-concept exploits are likely to emerge given the vulnerability's public disclosure. The vendor has not responded to early disclosure attempts, which may indicate a lack of responsiveness to security concerns.
Exploit Status
EPSS
0.12% (31% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2025-1597 is to immediately upgrade to version 1.0.1 of Best Church Management Software. If upgrading is not immediately feasible, consider implementing strict input validation on the 'a' parameter within the /admin/redirect.php file to prevent malicious script injection. Web application firewalls (WAFs) configured to detect and block XSS payloads can also provide a temporary layer of protection. Review access logs for suspicious activity related to the /admin/redirect.php endpoint. After upgrading, confirm the vulnerability is resolved by attempting to inject a simple JavaScript payload via the 'a' parameter and verifying that it is properly sanitized.
Update to a patched version of the software. If a patched version is not available, it is recommended to disable or remove the software until a fix is released. Validate and sanitize user input in the 'a' parameter in the /admin/redirect.php file to prevent the injection of malicious code.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2025-1597 is a cross-site scripting (XSS) vulnerability affecting SourceCodester Best Church Management Software versions 1.0–1.0, allowing attackers to inject malicious scripts via the /admin/redirect.php file.
You are affected if you are using SourceCodester Best Church Management Software version 1.0 or 1.0. Upgrade to version 1.0.1 to mitigate the risk.
Upgrade to version 1.0.1. As a temporary workaround, implement strict input validation on the 'a' parameter in /admin/redirect.php.
The vulnerability has been publicly disclosed, increasing the likelihood of exploitation. Active exploitation has not been confirmed, but is possible.
The vendor has not yet released an official advisory. Monitor the SourceCodester website and security forums for updates.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.