Closed toekhaing closed 4 months ago
Should fix this and most likely remove the external facing link to add a family to -- only allowing additions once logged in.
Should fix this and most likely remove the external facing link to add a family to -- only allowing additions once logged in.
Thanks for working on the fix. Please do not remove the capability to add a family without logging in especially since content can't be restricted by user role. Feature request: creating different user roles; restricting content viewing and editing by user roles.
Description
A stored XSS vulnerability has been found in Church CRM when the application default setting is open to register the family without the login.
"><img src=x onerror=alert(2)>
Steps To Reproduce
Logout your account and navigate to login page.
Click on Register a new Family and add the payload
"><img src=x onerror=alert(2)>
in Family name text field and register.Login to the application (Admin or others)
Navigate to Family page. (https://crm.site/v2/family) and you will get the xss alert.
Impact
Stored XSS attacks are even more significant in websites that require authentication. When an authenticated user visits a page with stored XSS, attackers are usually able to hijack their session and perform actions on their behalf. On some websites, such as those of financial or medical institutions, this can result in financial loss or exposure of highly sensitive data.
Remediation
In most situations where user-controllable data is copied into application responses, cross-site scripting attacks can be prevented using two layers of defenses: