PT-2025-51921 · Churchcrm · Churchcrm

Lukasz-Rybak · Published 2025-12-17 · Updated 2025-12-20 · CVE-2025-67875

Positive Technologies (AI Summary)

CVSS v4.0

8.5

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions ChurchCRM versions prior to 6.5.3

Description ChurchCRM is an open-source church management system. A flaw exists where an authenticated user with specific permissions ("Edit Records" and "Manage Properties and Classifications") can inject a persistent Cross-Site Scripting (XSS) payload into an administrator's profile. This payload executes when an administrator views their profile, potentially allowing an attacker to hijack the administrator’s session and perform administrative actions, leading to a full account takeover. The issue is a result of an Insecure Direct Object Reference (IDOR) allowing unauthorized profile viewing, combined with a Broken Access Control vulnerability permitting modification of user record properties.

Recommendations Versions prior to 6.5.3 should be updated to version 6.5.3 or later.

Exploit

Fix

LPE

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-67875

GHSA-FCW7-MMFH-7VJM

Affected Products

Churchcrm

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/67xxx/CVE-2025-67875.json · Exploit
• 🔥 https://github.com/ChurchCRM/CRM/security/advisories/GHSA-fcw7-mmfh-7vjm · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-67875 · Security Note
• https://osv.dev/vulnerability/CVE-2025-67875 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/2001472811278205072 · Twitter Post
• https://t.me/cveNotify/146234 · Telegram Post
• https://twitter.com/CVEnew/status/2002487822281007427 · Twitter Post