CVE-2025-0981

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-0981
A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to hijack a user's session by exploiting a Stored Cross Site Scripting (XSS) vulnerability in the Group Editor page. This allows admin users to inject malicious JavaScript in the description field, which captures the session cookie of authenticated users. The cookie can then be sent to an external server, enabling session hijacking. It can also lead to information disclosure, as exposed session cookies can be used to impersonate users and gain unauthorised access to sensitive information.

6.1 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://github.com/ChurchCRM/CRM/issues/7245 Exploit Issue Tracking Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:churchcrm:churchcrm:*:*:*:*:*:*:*:*
History

21 Feb 2025, 15:23

Type Values Removed Values Added
First Time Churchcrm
Churchcrm churchcrm
CPE cpe:2.3:a:churchcrm:churchcrm:*:*:*:*:*:*:*:*
CWE CWE-79
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.1
References () https://github.com/ChurchCRM/CRM/issues/7245 - () https://github.com/ChurchCRM/CRM/issues/7245 - Exploit, Issue Tracking, Third Party Advisory

19 Feb 2025, 09:15

Type Values Removed Values Added
Summary
  • (es) Existe una vulnerabilidad en ChurchCRM 5.13.0 y antes que permite a un atacante secuestrar una sesión de usuario explotando una vulnerabilidad de Cross Site Scripting (XSS) Almacenado en la página del editor de grupos. Esto permite a los usuarios administradores inyectar JavaScript malicioso, que captura la cookie de sesión de usuarios autenticados. La cookie se puede enviar a un servidor externo, lo que permite el secuestro de sesión. También puede conducir a la divulgación de información, ya que las cookies de sesión expuestas se pueden usar para hacerse pasar por usuarios y obtener acceso no autorizado a información confidencial.
Summary (en) A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to hijack a user's session by exploiting a Stored Cross Site Scripting (XSS) vulnerability in the Group Editor page. This allows admin users to inject malicious JavaScript, which captures the session cookie of authenticated users. The cookie can then be sent to an external server, enabling session hijacking. It can also lead to information disclosure, as exposed session cookies can be used to impersonate users and gain unauthorised access to sensitive information. (en) A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to hijack a user's session by exploiting a Stored Cross Site Scripting (XSS) vulnerability in the Group Editor page. This allows admin users to inject malicious JavaScript in the description field, which captures the session cookie of authenticated users. The cookie can then be sent to an external server, enabling session hijacking. It can also lead to information disclosure, as exposed session cookies can be used to impersonate users and gain unauthorised access to sensitive information.

18 Feb 2025, 10:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-02-18 10:15

Updated : 2025-02-21 15:23

NVD link : CVE-2025-0981

Mitre link : CVE-2025-0981

CVE.ORG link : CVE-2025-0981

JSON object : View

Products Affected

churchcrm

  • churchcrm
CWE
CWE-287

Improper Authentication

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')