CVE-2025-67876 (CNNVD-202512-3178)
中文标题:
ChurchCRM 跨站脚本漏洞
英文标题:
ChurchCRM has Stored XSS in Group Role Name Leading to Admin Session Hijacking
漏洞描述
中文描述:
ChurchCRM是ChurchCRM开源的一个为教会打造的开源 CRM 系统。 ChurchCRM 6.4.0及之前版本存在跨站脚本漏洞，该漏洞源于低权限用户可在组角色名称中注入持久性JavaScript，可能导致存储型跨站脚本攻击和账户接管。
英文描述:
ChurchCRM is an open-source church management system. A stored cross-site scripting (XSS) vulnerability exists in ChurchCRM versions 6.4.0 and prior that allows a low-privilege user with the “Manage Groups” permission to inject persistent JavaScript into group role names. The payload is saved in the database and executed whenever any user (including administrators) views a page that displays that role, such as GroupView.php or PersonView.php. This allows full session hijacking and account takeover. As of time of publication, no known patched versions are available.
CWE类型:
标签:
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| ChurchCRM | CRM | <= 6.4.0 | - | - |
cpe:2.3:a:churchcrm:crm:<=_6.4.0:*:*:*:*:*:*:*
|
| churchcrm | churchcrm | * | - | - |
cpe:2.3:a:churchcrm:churchcrm:*:*:*:*:*:*:*:*
|
解决方案
中文解决方案:
英文解决方案:
临时解决方案:
参考链接
cve.org
CVSS评分详情
4.0 (cna)
CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L
时间信息
利用信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2025-67876 |
2025-12-19 03:24:15 | 2026-01-12 02:12:27 |
| NVD | nvd_CVE-2025-67876 |
2025-12-19 03:25:39 | 2026-01-12 02:28:09 |
| CNNVD | cnnvd_CNNVD-202512-3178 |
2026-01-11 06:15:03 | 2026-01-12 02:38:02 |
版本与语言
安全公告
变更历史
查看详细变更
- vulnerability_type: 未提取 -> 跨站脚本
- cnnvd_id: 未提取 -> CNNVD-202512-3178
- data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
查看详细变更
- affected_products_count: 1 -> 2
- data_sources: ['cve'] -> ['cve', 'nvd']