ChurchCRM 在 PersonView.php 的 Facebook 字段属性注入中存在存储型 XSS 漏洞

该 XSS 漏洞的潜在影响非常严重。攻击者可以利用此漏洞执行恶意 JavaScript 代码，窃取用户的 Cookie 和会话信息，从而冒充用户执行各种操作。攻击者还可以利用此漏洞重定向用户到恶意网站，进行钓鱼攻击，或在受感染的 ChurchCRM 实例上显示虚假信息。由于该漏洞需要经过身份验证的用户，因此攻击者可能需要先获取 ChurchCRM 系统的凭据，或者利用其他漏洞来获取访问权限。该漏洞的攻击范围取决于 ChurchCRM 系统的部署方式和用户数量。

Churches and organizations using ChurchCRM versions 0.0.0 through 7.0 are at risk. This includes smaller churches relying on open-source solutions and organizations with limited security resources. Shared hosting environments where multiple ChurchCRM instances reside on the same server are particularly vulnerable, as a compromise of one instance could potentially impact others.

• php: Examine ChurchCRM's PersonView.php file for instances of sanitizeText() being used to sanitize HTML attributes. Search for suspicious JavaScript code within the Facebook field data. • generic web: Monitor access logs for requests to PersonView.php with unusual parameters or POST data. Look for patterns indicative of XSS attempts. • generic web: Use a WAF to detect and block XSS payloads targeting the Facebook field. Configure rules to identify and block requests containing suspicious JavaScript code. • generic web: Review user profiles for unexpected or malicious content in the Facebook field.

1. 2026-04-07Disclosure

   disclosure

1. 已保留2026-04-03
2. 发布日期2026-04-07
3. 修改日期2026-04-09
4. EPSS 更新日期2026-04-15

最有效的缓解措施是立即升级到 ChurchCRM 7.1.0 版本。如果无法立即升级，可以考虑以下临时缓解措施：限制 EditRecords 角色的用户数量，并对用户输入进行严格的验证和过滤。此外，可以配置 Web 应用防火墙 (WAF) 来检测和阻止 XSS 攻击。监控 ChurchCRM 系统的日志文件，查找可疑的 JavaScript 代码执行活动。在升级后，请确认漏洞已修复，通过创建包含恶意 payload 的用户个人资料，并检查其他用户是否会受到影响。