CVE-2023-26843 in ChurchCRM
Summary
by MITRE • 04/25/2023
A stored Cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via the NoteEditor.php.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 11/12/2025
The stored cross-site scripting vulnerability identified as CVE-2023-26843 exists within ChurchCRM version 4.5.3 and represents a critical security flaw that enables remote attackers to execute malicious scripts within the context of affected user sessions. This vulnerability specifically manifests through the NoteEditor.php component, which serves as a note-taking interface within the church management system. The flaw allows attackers to inject arbitrary web script or HTML code that gets stored on the server and subsequently executed when other users view the malicious notes, creating a persistent threat vector that can compromise user sessions and potentially escalate to full system compromise.
The technical implementation of this vulnerability stems from inadequate input validation and output sanitization within the NoteEditor.php script. When users create or edit notes through this interface, the application fails to properly sanitize user-supplied data before storing it in the database. This insufficient sanitization allows malicious payloads to be persisted in the system, where they are later retrieved and rendered without proper context-based escaping or encoding. The vulnerability is classified as a stored XSS attack because the malicious code is stored server-side and executed automatically when legitimate users access the affected content, unlike reflected XSS where the payload must be injected through links or forms. This characteristic makes the attack more dangerous and persistent, as it can affect multiple users over time without requiring repeated exploitation attempts.
The operational impact of this vulnerability extends beyond simple script execution, as it can enable attackers to perform a wide range of malicious activities including session hijacking, credential theft, data exfiltration, and privilege escalation. Attackers could potentially steal user authentication tokens, access sensitive church member information, modify or delete notes and data, and even use the compromised system as a pivot point for further attacks within the organization's network. The vulnerability affects all users who interact with the note-taking functionality, making it particularly dangerous for organizations that store sensitive personal information in their church management systems. Given that ChurchCRM is often used by religious organizations that may handle confidential personal data, the potential for misuse is significant, especially if attackers target specific individuals or groups within the congregation.
Organizations affected by this vulnerability should immediately implement multiple layers of defense to mitigate the risk. The primary mitigation strategy involves applying the vendor-provided patch or upgrade to ChurchCRM version 4.5.4 or later, which contains the necessary fixes for the XSS vulnerability. Additionally, implementing proper input validation and output encoding measures can provide defense-in-depth protection, ensuring that all user-supplied data is properly sanitized before storage and rendering. Web application firewalls and content security policies should be configured to detect and block suspicious script patterns, while regular security audits and penetration testing can help identify similar vulnerabilities. According to CWE guidelines, this vulnerability maps to CWE-79 which specifically addresses cross-site scripting flaws, and from an ATT&CK perspective, it aligns with techniques such as T1566.1 for credential access through malicious content and T1071.001 for application layer protocol usage. Network segmentation and least privilege access controls should also be enforced to limit the potential damage from successful exploitation, ensuring that even if one component is compromised, the attacker cannot easily move laterally within the organization's infrastructure.