.. / CVE-2023-25346

Exploit for ChurchCRM 4.5.3 - Cross-Site Scripting (CVE-2023-25346)

Description:

A reflected cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via the id parameter of /churchcrm/v2/family/not-found.

Nuclei Template

View the template here CVE-2023-25346.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2023/CVE-2023-25346.yaml
Copy

References:

https://github.com/10splayaSec/CVE-Disclosures/tree/main/ChurchCRM/CVE-2023-25346
https://github.com/ARPSyndicate/cvemon
https://github.com/ChurchCRM/CRM
https://nvd.nist.gov/vuln/detail/CVE-2023-25346
https://github.com/10splayaSec/CVE-Disclosures