CVE-2023-31548

Deeper analysis

A stored cross-site scripting vulnerability exists in the FundRaiserEditor.php component of ChurchCRM version 4.5.3. The flaw, tracked as CVE-2023-31548 and assigned CWE-79, permits an authenticated user to supply a crafted payload that is stored and later rendered as arbitrary web scripts or HTML when the page is viewed by other users. The issue carries a CVSS 3.1 score of 5.4, reflecting network attack vector, low attack complexity, low privileges required, and required user interaction, with limited confidentiality and integrity impact under changed scope.

An attacker who can create or edit FundRaiser content can embed malicious scripts that execute in the browsers of other authenticated users, enabling actions such as session hijacking, privilege escalation within the application, or theft of sensitive data displayed to those users. Because the payload persists in the database, the attack does not require repeated delivery after the initial injection.

The EPSS score for this CVE stands at 0.2350 with no material increase from its initial value, indicating limited observed exploitation interest to date. Public disclosure materials are limited to researcher repositories that reproduce the issue but contain no official patch guidance or mitigation statements from the ChurchCRM project.