ChurchCRM Reflected Cross-Site Scripting Vulnerability in Login Page

A reflected cross-site scripting vulnerability has been identified in ChurchCRM versions prior to 7.1.0. The issue arises on the login page, where the username parameter received from the URL is not properly sanitized or encoded. This lack of filtering allows attackers to inject malicious JavaScript, which can be executed on the client side. Successful exploitation could lead to the theft of sensitive information such as session cookies or manipulation of the page to display the attacker's login form.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where injected scripts are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, navigate to the login page and append a crafted username parameter to the URL. The injected script will be executed as soon as the page loads.

Remediation

Users can upgrade to ChurchCRM version 7.1.0 or later to address this vulnerability.