A stored cross-site scripting vulnerability in ChurchCRM versions prior to 7.1.0 allows authenticated attackers to perform session hijacking and full account takeover.

The application fails to properly escape quote characters within the PersonView.php file, allowing an authenticated user with the EditRecords role to inject malicious JavaScript into HTML attributes. This stored XSS payload executes when an administrator or other user views the compromised profile, leading to potential session hijacking.

Successful exploitation poses a significant risk to organizational integrity, as an attacker can gain unauthorized administrative access to the church management system. With a CVSS score of 7.6, this vulnerability represents a high-risk threat that could lead to the exposure of sensitive member data, unauthorized modification of records, and full compromise of the CRM environment.

Immediate Action: Upgrade ChurchCRM to version 7.1.0 or later to apply the necessary output sanitization fixes.

Proactive Monitoring: Review audit logs for suspicious activity involving profile modifications, particularly within the Facebook or social media fields of member records.

Compensating Controls: Deploy a Web Application Firewall with rules configured to detect and block common XSS patterns and malicious script injection attempts.

Public Exploit Available: Unknown.

Given the potential for complete account takeover, organizations using ChurchCRM must prioritize the update to version 7.1.0 immediately. Administrators should also audit existing user roles and permissions to ensure that only authorized personnel have access to edit sensitive profile fields, thereby reducing the attack surface for similar injection flaws.