Saadet-T

Name of the Vulnerable Software and Affected Versions ChurchCRM versions prior to 6.5.3 Description ChurchCRM, an open-source church management system, contains a Stored Cross-Site Scripting (Stored XSS) issue in the admin panel’s group-creation feature. A user with group-creation privileges can inject malicious JavaScript that executes when an administrator views the page. This can lead to the theft of the administrator’s session cookies and potential full administrative account takeover. Recommendations Update to version 6.5.3 or later.

**Name of the Vulnerable Software and Affected Versions** ChurchCRM versions prior to 6.5.3 **Description** ChurchCRM is an open-source church management system. The Database Restore functionality does not validate the content or file extension of uploaded files. This allows an attacker to upload a web shell file and subsequently upload a .htaccess file to enable direct access to it. Once accessed, the uploaded web shell allows remote code execution (RCE) on the server. The `Database Restore` functionality is the affected component. **Recommendations** Update ChurchCRM to version 6.5.3 to resolve this issue.

**Name of the Vulnerable Software and Affected Versions** ChurchCRM versions prior to 6.5.3 **Description** ChurchCRM is an open-source church management system. Versions prior to 6.5.3 may disclose database information in an error message, including the host, IP address, username, and password. **Recommendations** Update ChurchCRM to version 6.5.3 or later.

**Name of the Vulnerable Software and Affected Versions** Xibo versions prior to 3.3.10 Xibo versions prior to 4.0.9 Xibo version 1.8 Xibo version 2.3 **Description** Xibo is an Open Source Digital Signage platform with a web content management system and Windows display player software. In affected versions, some request headers are not correctly sanitized when stored in the session and display tables. These headers can be used to inject a malicious script into the session page to exfiltrate session IDs and User Agents. These session IDs / User Agents can subsequently be used to hijack active sessions. A malicious script can be injected into the display grid to exfiltrate information related to displays. **Recommendations** For Xibo versions prior to 3.3.10, upgrade to version 3.3.10. For Xibo versions prior to 4.0.9, upgrade to version 4.0.9. For Xibo version 1.8, apply the patch a81044e6ccdd92cc967e34c125bd8162432e51bc.diff. For Xibo version 2.3, apply the patch ebeccd000b51f00b9a25f56a2f252d6812ebf850.diff. As a temporary workaround, consider restricting access to the session and display tables until a patch is available. Avoid using the vulnerable request headers in the affected API endpoints until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Xibo versions prior to 3.3.10 Xibo versions prior to 4.0.9 Xibo version 1.8 Xibo version 2.3 **Description** Xibo is an Open Source Digital Signage platform with a web content management system and Windows display player software. Session tokens are exposed in the return of session search API call on the sessions page. Subsequently, they can be exfiltrated and used to hijack a session. Users must be granted access to the session page, or be a super admin. **Recommendations** For Xibo versions prior to 3.3.10, upgrade to version 3.3.10. For Xibo versions prior to 4.0.9, upgrade to version 4.0.9. For Xibo version 1.8, apply the patch a81044e6ccdd92cc967e34c125bd8162432e51bc.diff. For Xibo version 2.3, apply the patch ebeccd000b51f00b9a25f56a2f252d6812ebf850.diff. As a temporary workaround, consider restricting access to the sessions page to minimize the risk of exploitation.