Session Hijacking via Reflected Cross-Site Scripting (XSS) in ChurchCRM EditEventAttendees.php EID Parameter

Published 20 mo ago 2025-02-19 · modified 4 mo ago 2026-06-17 · JSON

CVSS

4.8

v3.1 · NVD

CISA KEV

not known exploited

EPSS

0.3%

percentile 22%

Public exploits

none known

A vulnerability exists in ChurchCRM 5.13.0 that allows an attacker to execute arbitrary JavaScript in a victim's browser via Reflected Cross-Site Scripting (XSS) in the EditEventAttendees.php page. This requires Administration privileges and affects the EID parameter. The flaw allows an attacker to steal session cookies, perform actions on behalf of an authenticated user, and gain unauthorized access to the application.

CISA SSVC assessment

Exploitation: Proof of concept public
Automatable: no
Technical impact: total
Assessed: 20 mo ago 2025-02-19

Exploit prediction (EPSS)

0.29% probability of exploitation in the next 30 days, higher than 22% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CNA	4.0	8.4	`CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:L/VA:H/SC:H/SI:L/SA:H/AU:Y/R:U/V:C/RE:L/U:Amber`
CNA	4.0	8.4	`CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:L/VA:H/SC:H/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:L/U:Amber`
NVD	3.1	4.8	`CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N`

Affected products

ChurchCRM ChurchCRM

Classification

Weakness

CWE-287 Improper Authentication
CWE-79 Improper Neutralization of Input During Web Page Generation

References

github.com /ChurchCRM/CRM/issues/7250

Sources

CVE List: CVE-2025-1024
NVD: CVE-2025-1024

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary