SourceCodester Best Church Management Software redirect.php cross site scripting

Successful exploitation of CVE-2025-1597 enables an attacker to inject arbitrary JavaScript code into the Best Church Management Software application. This can be leveraged to steal user credentials, redirect users to malicious websites, or modify the application's behavior. The impact is particularly severe for administrative users, as their accounts could be compromised, granting the attacker full control over the church management system. The remote nature of the vulnerability means it can be exploited from anywhere with network access to the affected system. While the CVSS score is LOW, the potential for data theft and system compromise warrants immediate attention.

Churches and religious organizations utilizing SourceCodester Best Church Management Software, particularly those running versions 1.0 through 1.0, are at risk. Organizations relying on this software for sensitive data management, such as member information and financial records, face a heightened risk of compromise.

• php: Examine access logs for requests to /admin/redirect.php with unusual or suspicious values in the a parameter.

 grep "/admin/redirect.php?a=" /var/log/apache2/access.log | less

• generic web: Use curl to test the /admin/redirect.php endpoint with a simple XSS payload (e.g., <script>alert(1)</script>).

curl 'http://example.com/admin/redirect.php?a=<script>alert(1)</script>'

• generic web: Check response headers for signs of script injection or unexpected behavior.

1. 2025-02-23Disclosure

   disclosure

1. आरक्षित2025-02-22
2. प्रकाशित2025-02-23
3. संशोधित2025-02-24
4. EPSS अद्यतन2026-04-02

The primary mitigation for CVE-2025-1597 is to immediately upgrade to version 1.0.1 of Best Church Management Software. If upgrading is not immediately feasible, consider implementing strict input validation on the 'a' parameter within the /admin/redirect.php file to prevent malicious script injection. Web application firewalls (WAFs) configured to detect and block XSS payloads can also provide a temporary layer of protection. Review access logs for suspicious activity related to the /admin/redirect.php endpoint. After upgrading, confirm the vulnerability is resolved by attempting to inject a simple JavaScript payload via the 'a' parameter and verifying that it is properly sanitized.