Multiple cross-site scripting (XSS) vulnerabilities were discovered in Church CRM v4.5.3 in GroupReports.php via GroupRole, ReportModel, and OnlyCart parameters.

**If you have the ChurchCRM software running, please file an issue using the _Report an issue_ in the help menu.**

**On what page in the application did you find this issue?**

/churchcrm/GroupReports.php

**On what type of server is this running? Dedicated / Shared hosting? Linux / Windows?**

Linux

**What browser (and version) are you running?**

Firefox

**What version of PHP is the server running?**

7.4.33

**What version of SQL Server are you running?**

5.7.26

**What version of ChurchCRM are you running?**

4.5.3

Description:  
XSS was detected in GroupReports.php, three hidden parameters were found in the code of this page, in which this vulnerability is possible: GroupRole, ReportModel, OnlyCart. A browser cannot know if the script should be trusted or not, it will execute the script in the user context allowing the attacker to access any cookies or session tokens retained by the browser.

Impact:  
The vulnerability allows an attacker to send malicious JavaScript code which could result in hijacking of the user's cookie/session tokens , redirecting the user to a malicious webpage, downloading malicious files hosted on attackers server and performing many other unintended browser actions

Proof of Concept:  
**<script>alert('XSS')</script>**

CVE-2023-33661: XSS exists in the group report page · Issue #6474 · ChurchCRM/CRM

PHPgurukl Hostel Management System v.1.0 is vulnerable to Cross Site Scripting (XSS).

\# Hostel Management System v.1.0 - Stored Cross-Site Scripting (XSS)Vulnerability

\## Stored Cross Site Scripting Vulnerability found in Hostel Management System v.1.0

Vulnerability Description -

The Hostel Management System v.1.0, developed by PHPGurukul, is susceptible to a critical security vulnerability known as Stored Cross-Site Scripting (XSS). This vulnerability enables attackers to inject malicious JavaScript code, which is then stored and executed by the application.

Steps to Reproduce -

The following steps demonstrate how to exploit the Stored XSS vulnerability in the Hostel Management System v.1.0:

1\. Visit the Hostel Management System v.1.0 application by accessing the URL: http://localhost/hostel/index.php.

2\. Click on the "Sign Up" and Creat New User Account

"First Name" "Last Name" field, inject the following XSS payload, enclosed in brackets: {"><script>alert("XSS")</script>}.

3\. Click on the "Submit" button.

4\. Login to the Account using the Email id and Password Which You Have Entered, injected payload will be executed.

As a result of successful exploitation, the injected JavaScript code will be stored in the application's database. Subsequently, whenever another user accesses the affected page, the injected code will execute, triggering an alert displaying the text "XSS." This allows the attacker to execute arbitrary code within the user's browser, potentially leading to further attacks or unauthorized actions.

\*\*Reference: CVE-2023-34647\*\*

CVE-2023-34647: Common-Vulnerabilities-and-Exposures/CVE-2023-34647 at main · ckalnarayan/Common-Vulnerabilities-and-Exposures

Interactsh is an open-source tool for detecting out-of-band interactions. Domains configured with interactsh server prior to version 1.0.0 were vulnerable to subdomain takeover for a specific subdomain, i.e `app.` Interactsh server used to create cname entries for `app` pointing to `projectdiscovery.github.io` as default, which intended to used for hosting interactsh web client using GitHub pages. This is a security issue with a self-hosted interactsh server in which the user may not have configured a web client but still have a CNAME entry pointing to GitHub pages, making them vulnerable to subdomain takeover. This allows a threat actor to host / run arbitrary client side code (cross-site scripting) in a user's browser when browsing the vulnerable subdomain. Version 1.0.0 fixes this issue by making CNAME optional, rather than default.

**Have a question about this project?** Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Pick a username

Email Address

Password

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

CVE-2023-36474: Making app CNAME optional by Mzack9999 · Pull Request #155 · projectdiscovery/interactsh

PHPgurukl Hostel Management System v.1.0 is vulnerable to Cross Site Scripting (XSS) via Add New Course.

\# Hostel Management System v.1.0 - Stored Cross-Site Scripting (XSS)Vulnerability

\## Stored Cross Site Scripting Vulnerability found in Hostel Management System v.1.0

Vulnerability Description -

The Hostel Management System v.1.0, developed by PHPGurukul, is susceptible to a critical security vulnerability known as Stored Cross-Site Scripting (XSS). This vulnerability enables attackers to inject malicious JavaScript code, which is then stored and executed by the application.

Steps to Reproduce -

The following steps demonstrate how to exploit the Stored XSS vulnerability in the Hostel Management System v.1.0:

1\. Visit the Hostel Management System v.1.0 application by accessing the URL: http://localhost/hostel/index.php.

2\. Click on the "Admin" button to navigate to the admin login page.

3\. Login to the Admin account using the default credentials.

\- Username: admin

\- Password: Test@123

4\. Proceed to the Admin Profile page.

5\. Click on Courses, and Add New Course, Within the "Course Code" "Course Name(Short)" "Course Name(Full)" field, inject the following XSS payload, enclosed in brackets: {"><script>alert("XSS")</script>}.

6\. Click on the "Submit" button.

7\. Refresh the page, and the injected payload will be executed.

As a result of successful exploitation, the injected JavaScript code will be stored in the application's database. Subsequently, whenever another user accesses the affected page, the injected code will execute, triggering an alert displaying the text "XSS." This allows the attacker to execute arbitrary code within the user's browser, potentially leading to further attacks or unauthorized actions.

\*\*Reference: CVE-2023-34652\*\*

CVE-2023-34652: Common-Vulnerabilities-and-Exposures/CVE-2023-34652 at main · ckalnarayan/Common-Vulnerabilities-and-Exposures

PHPgurukl Hospital Management System v.1.0 is vulnerable to Cross Site Scripting (XSS).

Permalink

Cannot retrieve contributors at this time

\# Hospital Management System in php v.1.0 - Stored Cross-Site Scripting (XSS)Vulnerability

\## Stored Cross Site Scripting Vulnerability found in Hospital Management System in php v.1.0

Vulnerability Description -

The Hospital Management System in php v.1.0, developed by PHPGurukul, is susceptible to a critical security vulnerability known as Stored Cross-Site Scripting (XSS). This vulnerability enables attackers to inject malicious JavaScript code, which is then stored and executed by the application.

Steps to Reproduce -

The following steps demonstrate how to exploit the Stored XSS vulnerability in the Hostel Management System v.1.0:

1\. Visit the Hospital Management System in php v.1.0 application by accessing the URL: http://localhost/hospital/

2\. Click on the "Patient Login" and Creat New Patient Account

"Full Name" "Address" "City" field, inject the following XSS payload, enclosed in brackets: {"><script>alert("XSS")</script>}.

3\. Click on the "Submit" button.

3\. Login to the Patient account using the Email id and Password Which You Have Entered, injected payload will be executed.

4\. Go to the Edit Account Details Page,

"Full Name" "Address" "City" field, inject the following XSS payload, enclosed in brackets: {"><script>alert("XSS")</script>}.

6\. Click on the "Submit" button.

7\. Refresh the page, and the injected payload will be executed.

As a result of successful exploitation, the injected JavaScript code will be stored in the application's database. Subsequently, whenever another user accesses the affected page, the injected code will execute, triggering an alert displaying the text "XSS." This allows the attacker to execute arbitrary code within the user's browser, potentially leading to further attacks or unauthorized actions.

\*\*Reference: CVE-2023-34651\*\*

CVE-2023-34651: Common-Vulnerabilities-and-Exposures/CVE-2023-34651 at main · ckalnarayan/Common-Vulnerabilities-and-Exposures

PHPgurukl Small CRM v.1.0 is vulnerable to Cross Site Scripting (XSS).

\# Small CRM v.1.0 - Stored Cross-Site Scripting (XSS)Vulnerability

\## Stored Cross Site Scripting Vulnerability found in Small CRM v.1.0

Vulnerability Description -

The Small CRM v.1.0, developed by PHPGurukul, is susceptible to a critical security vulnerability known as Stored Cross-Site Scripting (XSS). This vulnerability enables attackers to inject malicious JavaScript code, which is then stored and executed by the application.

Steps to Reproduce -

The following steps demonstrate how to exploit the Stored XSS vulnerability in the Hostel Management System v.1.0:

1\. Visit the Small CRM v.1.0 application by accessing the URL: http://localhost/crm/index.php

2\. Click on the "User Sign Up" and Creat New User Account

"Name" field, inject the following XSS payload, enclosed in brackets: {"><script>alert("XSS")</script>}.

3\. Click on the "Submit" button.

4\. Login to the User account using the Email id and Password Which You Have Entered, injected payload will be executed.

5\. Also Login Through Admin Account, Click on Users Option

6\. Refresh the page, and the injected payload will be executed.

As a result of successful exploitation, the injected JavaScript code will be stored in the application's database. Subsequently, whenever another user accesses the affected page, the injected code will execute, triggering an alert displaying the text "XSS." This allows the attacker to execute arbitrary code within the user's browser, potentially leading to further attacks or unauthorized actions.

\*\*Reference: CVE-2023-34650\*\*

CVE-2023-34650: Common-Vulnerabilities-and-Exposures/CVE-2023-34650 at main · ckalnarayan/Common-Vulnerabilities-and-Exposures

Emby Server versions < 4.6.0.50 is vulnerable to Cross Site Scripting (XSS) vulnerability via a crafted GET request to /web.

Two years ago I reported an issue regarding a Cross-Site Scripting vulnerability in the \*nux version of Emby Media Server:

    I found a Reflected Cross-Site Scripting as well. Everything after /web/ is reflected. See the attachments for an example: [http://<ip>:8096/web/<script>alert(document.location)</script>](http://<ip>:8096/web/%3Cscript%3Ealert(document.location)%3C/script%3E)
    
    EDIT: This issue only affects the *nux version of the app, the Windows version seems fine.
    

I tested this and I confirm that this issue has been resolved.  
This vulnerability is known as CVE-2021-25828.

CVE-2021-25828: Reflected Cross-Site Scripting (XSS) (CVE-2021-25828) · Issue #3785 · MediaBrowser/Emby

NewsLetter Script version 2.4 suffers from a cross site scripting vulnerability.

    ┌┌───────────────────────────────────────────────────────────────────────────────────────┐││                                     C r a C k E r                                    ┌┘┌┘                 T H E   C R A C K   O F   E T E R N A L   M I G H T                  ││└───────────────────────────────────────────────────────────────────────────────────────┘┘ ┌────              From The Ashes and Dust Rises An Unimaginable crack....          ────┐┌┌───────────────────────────────────────────────────────────────────────────────────────┐┌┘                                  [ Vulnerability ]                                   ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘:  Author   : CraCkEr                                                                    :│  Website  : https://simplephpscripts.com/newsletter-script-php/                        ││  Vendor   : SimplePHPscripts                                                           ││  Software : NewsLetter Script 2.4                                                      ││  Vuln Type: Reflected XSS                                                              ││  Impact   : Manipulate the content of the site                                         ││                                                                                        ││────────────────────────────────────────────────────────────────────────────────────────││                                                                                       ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘:                                                                                        :│  Release Notes:                                                                        ││  ═════════════                                                                         ││  The attacker can send to victim a link containing a malicious URL in an email or      ││  instant message can perform a wide variety of actions, such as stealing the victim's  ││  session token or login credentials                                                    ││                                                                                        │┌┌───────────────────────────────────────────────────────────────────────────────────────┐┌┘                                                                                      ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘Greets:    The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL , MoizSid09           CryptoJob (Twitter) twitter.com/0x0CryptoJob     ┌┌───────────────────────────────────────────────────────────────────────────────────────┐┌┘                                    © CraCkEr 2023                                    ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘Path: /preview.phpURL parameter is vulnerable to RXSShttps://website/preview.php/tb0g5"><script>alert(1)</script>kp1ea?cat_id=4[-] Done

NewsLetter Script 2.4 Cross Site Scripting

Red Hat Security Advisory 2023-3885-01 - Red Hat Single Sign-On 7.6 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications. This release of Red Hat Single Sign-On 7.6.4 on RHEL 9 serves as a replacement for Red Hat Single Sign-On 7.6.3, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References. Issues addressed include a cross site scripting vulnerability.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256

=====================================================================  
                   Red Hat Security Advisory

Synopsis:          Important: Red Hat Single Sign-On 7.6.4 security update on RHEL 9  
Advisory ID:       RHSA-2023:3885-01  
Product:           Red Hat Single Sign-On  
Advisory URL:      https://access.redhat.com/errata/RHSA-2023:3885  
Issue date:        2023-06-27  
CVE Names:         CVE-2022-4361 CVE-2023-1108 CVE-2023-1664   
                   CVE-2023-2422 CVE-2023-2585   
=====================================================================

1. Summary:

New Red Hat Single Sign-On 7.6.4 packages are now available for Red Hat  
Enterprise Linux 9.

Red Hat Product Security has rated this update as having a security impact  
of Important. A Common Vulnerability Scoring System (CVSS) base score,  
which gives a detailed severity rating, is available for each vulnerability  
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Single Sign-On 7.6 for RHEL 9 - noarch

3. Description:

Red Hat Single Sign-On 7.6 is a standalone server, based on the Keycloak  
project, that provides authentication and standards-based single sign-on  
capabilities for web and mobile applications.

This release of Red Hat Single Sign-On 7.6.4 on RHEL 9 serves as a  
replacement for Red Hat Single Sign-On 7.6.3, and includes bug fixes and  
enhancements, which are documented in the Release Notes document linked to  
in the References.

Security Fix(es):

* keycloak: Cross-site scripting when validating URI-schemes on SAML and  
OIDC (CVE-2022-4361)

* undertow: Infinite loop in SslConduit during close (CVE-2023-1108)

* keycloak: oauth client impersonation (CVE-2023-2422)

* keycloak: Untrusted Certificate Validation (CVE-2023-1664)

* keycloak: client access via device auth request spoof (CVE-2023-2585)

For more details about the security issue(s), including the impact, a CVSS  
score, and other related information, refer to the CVE page(s) listed in  
the References section.

4. Solution:

Before applying this update, make sure all previously released errata  
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

2151618 - CVE-2022-4361 Keycloak | RHSSO: XSS due to lax URI scheme validation  
2174246 - CVE-2023-1108 Undertow: Infinite loop in SslConduit during close  
2182196 - CVE-2023-1664 keycloak: Untrusted Certificate Validation  
2191668 - CVE-2023-2422 keycloak: oauth client impersonation  
2196335 - CVE-2023-2585 keycloak: client access via device auth request spoof

6. Package List:

Red Hat Single Sign-On 7.6 for RHEL 9:

Source:  
rh-sso7-keycloak-18.0.8-1.redhat_00001.1.el9sso.src.rpm

noarch:  
rh-sso7-keycloak-18.0.8-1.redhat_00001.1.el9sso.noarch.rpm  
rh-sso7-keycloak-server-18.0.8-1.redhat_00001.1.el9sso.noarch.rpm

These packages are GPG signed by Red Hat for security.  Our key and  
details on how to verify the signature are available from  
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2022-4361  
https://access.redhat.com/security/cve/CVE-2023-1108  
https://access.redhat.com/security/cve/CVE-2023-1664  
https://access.redhat.com/security/cve/CVE-2023-2422  
https://access.redhat.com/security/cve/CVE-2023-2585  
https://access.redhat.com/security/updates/classification/#important  
https://access.redhat.com/articles/11258

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact  
details at https://access.redhat.com/security/team/contact/

Copyright 2023 Red Hat, Inc.  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1

iQIVAwUBZJtZztzjgjWX9erEAQjeQQ/8CQn1wk1u2E7anYq+jjzC83Dr7yd6ePLw  
ZKwmFO7hFeP6e9Vpxo26pQ6MSMBdRDSWdO8evS6VcH8fE3D2Xg2hoqDeF5mqbDlx  
aDILyQfea9922X7038j3zPKFXzmQE78jqteFgQatwL3niG1o9JSKYpuNmZoX594x  
x+BAMSbHjmnvCbgc+IdbWLi0egWLKphjuquXrJMGdIsROcpmT4rdhthb4Nw6rpNf  
pI9wxPkBXPNL711X7dR0GOvb7fQTrgcK0LLE3BQtwDyLXLu4DW1rGLB6C9TnCITi  
pXjGWh8sGA9JEFUbRf/1FEZm2tTcggaEhWwUwM+IrKbYSLYfpZdlJWreP6RkSUaI  
Y/cEtGbt2bUwN37TtInd8QHKGlWoWHpYjKWQiQADtyirvnZAI54Mdz7hpk/kRJyJ  
Nn374WNZuSeaMKewLMLr40zkWgROnj+drj0DjTM29mZkhs/PcPNSuZWNBxoiBwMg  
jorkQ3e4RzgYdrrqehiFfh2tcKOjud+Iy2X5j3k7ACQ3Y1b35FmUl1WkX4xr1lcm  
JytPdFMtuc7IykZX9vVEvfadCSRGSAy/6jJTJsIA41wmPBaZARN75LPFaVTReKIR  
2i3azgTnN1XNps/+YAu3DKBsRnJRPkbzKE4WHWbW4XmV4UU/cdqgcBki8NLTqqV/  
3zMnfahNkfs=  
=qCpB  
-----END PGP SIGNATURE-----  
--  
RHSA-announce mailing list  
RHSA-announce@redhat.com  
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Red Hat Security Advisory 2023-3885-01

Simple Forum version 2.7 suffers from a cross site scripting vulnerability.

    ┌┌───────────────────────────────────────────────────────────────────────────────────────┐││                                     C r a C k E r                                    ┌┘┌┘                 T H E   C R A C K   O F   E T E R N A L   M I G H T                  ││└───────────────────────────────────────────────────────────────────────────────────────┘┘ ┌────              From The Ashes and Dust Rises An Unimaginable crack....          ────┐┌┌───────────────────────────────────────────────────────────────────────────────────────┐┌┘                                  [ Vulnerability ]                                   ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘:  Author   : CraCkEr                                                                    :│  Website  : https://simplephpscripts.com/simple-forum-php/                             ││  Vendor   : SimplePHPscripts                                                           ││  Software : Simple Forum 2.7                                                           ││  Vuln Type: Reflected XSS                                                              ││  Impact   : Manipulate the content of the site                                         ││                                                                                        ││────────────────────────────────────────────────────────────────────────────────────────││                                                                                       ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘:                                                                                        :│  Release Notes:                                                                        ││  ═════════════                                                                         ││  The attacker can send to victim a link containing a malicious URL in an email or      ││  instant message can perform a wide variety of actions, such as stealing the victim's  ││  session token or login credentials                                                    ││                                                                                        │┌┌───────────────────────────────────────────────────────────────────────────────────────┐┌┘                                                                                      ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘Greets:    The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL , MoizSid09           CryptoJob (Twitter) twitter.com/0x0CryptoJob     ┌┌───────────────────────────────────────────────────────────────────────────────────────┐┌┘                                    © CraCkEr 2023                                    ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘Path: /preview.phpURL parameter is vulnerable to RXSShttps://website/preview.php/g63ed"><script>alert(1)</script>e1nm2?act=new&cat_id=Path: /preview.phpGET 'p' parameter is vulnerable to RXSShttps://website/preview.php?p=b35ek%22%3e%3cscript%3ealert(1)%3c%2fscript%3eqr2hm&cat_id=&ordType=ASC&ordBy=publish_date[-] Done

Tag

#xss