PT-2026-32399 · Churchcrm · Churchcrm
CVSS v4.0
5.3
Medium
| Vector | AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
ChurchCRM versions prior to 7.0.0
Description
An open-source church management system allows the creation of links that can redirect authenticated users to an arbitrary URL chosen by an attacker when the 'Cancel' button is clicked. This issue occurs in multiple locations across the application, such as in
DonatedItemEditor.php, specifically where the linkBack variable is utilized.Recommendations
Update to version 7.0.0.
Exploit
Fix
Open Redirect
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Churchcrm