A reflected cross-site scripting vulnerability in ChurchCRM versions prior to 7.1.0 allows an authenticated attacker to execute malicious scripts in the context of another user's session.

This is a reflected cross-site scripting (XSS) vulnerability occurring at the FindFundRaiser.php endpoint, where user-supplied input via DateStart and DateEnd parameters is inadequately encoded for the HTML attribute context. The flaw permits an authenticated attacker to execute arbitrary JavaScript when a targeted user visits a crafted URL.

The exploitation of this vulnerability could lead to unauthorized actions performed on behalf of legitimate users, including administrative personnel. Given the CVSS score of 8.7, the potential for session hijacking, data theft, or unauthorized configuration changes poses a significant risk to the integrity of the church management system and the sensitive data it stores.

Immediate Action: Upgrade ChurchCRM to version 7.1.0 or later to apply the necessary output encoding fixes.

Proactive Monitoring: Review application access logs for suspicious URL parameters containing script tags or encoded JavaScript patterns directed at the FindFundRaiser.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common XSS payloads, specifically targeting reflected input in URL parameters.

Public Exploit Available: No

This vulnerability represents a high-severity risk due to the potential for privilege escalation and session compromise within the CRM. Administrators should prioritize the update to version 7.1.0 immediately to prevent potential exploitation. In environments where an immediate patch is not feasible, restrict access to the affected endpoint through network-level controls or WAF rules.