A high-severity reflected XSS vulnerability in ChurchCRM versions prior to 7.1.0 allows authenticated users to compromise other user accounts, including administrative sessions.

This is a reflected Cross-Site Scripting (XSS) flaw located in GeoPage.php. The vulnerability allows any authenticated user to inject malicious JavaScript that executes automatically in the browser of another authenticated user without interaction, facilitating session hijacking.

The ability for an attacker to hijack administrative sessions presents a significant security risk to the organization. Successful exploitation could lead to unauthorized access to sensitive member data, financial records, or system configuration, causing severe reputational damage and potential loss of data integrity. Given the CVSS score of 8.7, this vulnerability is considered a high-priority risk that requires immediate attention.

Immediate Action: Upgrade ChurchCRM to version 7.1.0 or later to apply the necessary security patches and input sanitization.

Proactive Monitoring: Review web access logs for suspicious requests targeting GeoPage.php or unusual script execution patterns within the application.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict XSS filtering rules to inspect and block malicious payloads directed at the application.

Public Exploit Available: Unknown.

Given the potential for complete account takeover, including administrative accounts, organizations should treat this vulnerability with high urgency. Administrators must prioritize the update to version 7.1.0 to eliminate the injection vector. Until the patch is applied, ensure that access to the CRM is restricted to trusted users and monitor session activity for anomalies.