CVE-2025-1024 Details

A reflected cross-site scripting vulnerability has been identified in ChurchCRM version 5.13.0, specifically on the EditEventAttendees.php page. This issue allows an attacker with administrative privileges to execute arbitrary JavaScript in the context of a victim's browser, targeting the EID parameter. The exploitation of this vulnerability could lead to session hijacking, as attackers can steal session cookies, impersonate users, and gain unauthorized access to the application.

To address this vulnerability, ChurchCRM should implement output encoding to neutralize script injections in user-controlled parameters. Additionally, a Content Security Policy (CSP) should be used to restrict JavaScript execution from untrusted sources. All cookies should be set with HttpOnly and Secure flags to prevent client-side access. Finally, input validation and sanitization should be performed before rendering user-controlled data in the response.