Reflected XSS op de inlogpagina via de 'username' parameter

The impact of this XSS vulnerability is significant, as it can be exploited to compromise user accounts and potentially gain control of the ChurchCRM application. An attacker could craft a malicious URL containing JavaScript code and send it to a ChurchCRM user. When the user clicks the link, the JavaScript code will execute in their browser, allowing the attacker to steal their session cookie and impersonate them. Alternatively, the attacker could inject JavaScript code that replaces the legitimate login form with a fake one, tricking users into entering their credentials, which are then sent to the attacker. This could lead to unauthorized access to sensitive church data, including member information, financial records, and event details.

Churches and organizations utilizing ChurchCRM versions 0.0.0 through 7.0 are at risk. This includes deployments with limited security expertise and those relying on default configurations. Shared hosting environments where multiple ChurchCRM instances reside on the same server are particularly vulnerable, as a successful attack on one instance could potentially compromise others.

• php: Examine ChurchCRM application logs for suspicious URL parameters containing JavaScript code in the username field. Use grep to search for patterns like <script> or alert() within the logs.

grep -i '<script>.*alert\(.*\)' /var/log/apache2/access.log

• generic web: Monitor access logs for requests to the login page with unusual or excessively long username parameters. Use curl to test the login page with a simple XSS payload and observe the response.

curl 'http://churchcrm.example.com/login.php?username=<script>alert("XSS")</script>' -s

1. 2026-04-07Disclosure

   disclosure

1. Gereserveerd2026-04-06
2. Gepubliceerd2026-04-07
3. Gewijzigd2026-04-08
4. EPSS bijgewerkt2026-04-15

The primary mitigation for CVE-2026-39344 is to upgrade ChurchCRM to version 7.1.0 or later, which includes the necessary sanitization and encoding of the username parameter. If an immediate upgrade is not possible, consider implementing a Web Application Firewall (WAF) rule to filter out malicious JavaScript code in the username parameter. Additionally, carefully review and sanitize all user inputs within the ChurchCRM application to prevent similar vulnerabilities from arising. After upgrading, verify the fix by attempting to inject a simple JavaScript payload (e.g., <script>alert('XSS')</script>) into the username parameter of the login URL and confirming that it is not executed.