Vulnerability details

CVE-2025-67875

ChurchCRM CRM

ChurchCRM has stored XSS via Person Property Assignment Leading to Admin Session Hijacking

CVSS 4.0

8.5High

Official description

ChurchCRM is an open-source church management system. A privilege escalation vulnerability exists in ChurchCRM prior to version 6.5.3. An authenticated user with specific mid-level permissions ("Edit Records" and "Manage Properties and Classifications") can inject a persistent Cross-Site Scripting (XSS) payload into an administrator's profile. The payload executes when the administrator views their own profile page, allowing the attacker to hijack the administrator's session, perform administrative actions, and achieve a full account takeover. This vulnerability is a combination of two separate flaws: an Insecure Direct Object Reference (IDOR) that allows any user to view any other user's profile, and a Broken Access Control vulnerability that allows a user with general edit permissions to modify any other user's record properties. Version 6.5.3 fixes the issue.

CVSS scores

Score	Version	Source	Vector
8.5High	4.0	CVEProject cvelistV5 (CNA) (GitHub_M)	`CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`

Affected products

Vendor	Product	Versions	Source
ChurchCRM	CRM	< 6.5.3	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/ChurchCRM/CRM/security/advisories/GHSA-fcw7-mmfh-7vjm x_refsource_CONFIRM

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2025-12-18
Last updated: 2025-12-18
State: Published
Assigner (CNA): GitHub_M

Exploit prediction (EPSS)

0.19%

Probability of exploitation in 30 days

9.3%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: Proof of concept
Technical impact: Total

Weaknesses (CWE)

CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')