CVE-2025-8167: Church Donation System XSS Vulnerability

CVE-2025-8167 Overview

CVE-2025-8167 is a cross-site scripting (XSS) vulnerability in code-projects Church Donation System 1.0. The flaw resides in the /admin/edit_members.php script, where the fname parameter is rendered without proper output encoding. An authenticated remote attacker can inject arbitrary JavaScript that executes in the browser context of any user viewing the affected page. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). Public disclosure includes technical details and proof-of-concept references. Other parameters in the same endpoint may also be affected.

Critical Impact
Successful exploitation allows an authenticated attacker to execute arbitrary script code in administrator browsers, enabling session token theft, unauthorized administrative actions, and defacement of the donation management interface.

Affected Products

Carmelo Church Donation System 1.0
/admin/edit_members.php endpoint
fname parameter (and potentially additional parameters)

Discovery Timeline

2025-07-25 - CVE-2025-8167 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-8167

Vulnerability Analysis

The vulnerability is a reflected or stored cross-site scripting flaw in the administrative member-editing workflow of Church Donation System 1.0. The application accepts user-controlled input through the fname parameter submitted to /admin/edit_members.php and writes it back into the HTML response without contextual output encoding. When an administrator or other privileged user renders the affected page, injected script executes with the privileges of that session.

The attack is network-reachable and requires low privileges to submit the payload, plus user interaction to trigger execution. Impact is limited to integrity of client-side rendering; confidentiality and availability are not directly affected at the server level. However, an attacker can leverage the flaw to hijack administrator sessions and pivot to broader administrative control. The public advisory notes that additional parameters on the same endpoint may share the same weakness.

Root Cause

The root cause is missing input validation and missing output encoding of the fname request parameter before it is embedded in server-generated HTML. The PHP handler for /admin/edit_members.php does not apply functions such as htmlspecialchars() or a context-aware templating layer, allowing HTML and JavaScript metacharacters to pass through unfiltered.

Attack Vector

An attacker with a low-privileged authenticated session crafts a request to /admin/edit_members.php containing a JavaScript payload in the fname field. When a privileged user subsequently views the affected members page, the browser parses and executes the injected script. Delivery methods include a phishing link, a malicious form submission, or embedding the payload in stored member records. Refer to the GitHub CVE Issue Discussion and VulDB entry #317581 for the publicly disclosed proof of concept.

Detection Methods for CVE-2025-8167

Indicators of Compromise

HTTP POST or GET requests to /admin/edit_members.php containing HTML tags such as <script>, <img onerror=, or <svg onload= in the fname parameter.
Unexpected outbound requests from administrator browsers to attacker-controlled domains, indicating session token exfiltration.
Member records in the database containing HTML or JavaScript syntax in name fields.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect parameters submitted to /admin/edit_members.php for XSS payload signatures.
Enable verbose HTTP request logging on the PHP application server and alert on non-alphabetic characters in name fields.
Perform periodic database scans for stored member records containing angle brackets, event handlers, or JavaScript URI schemes.

Monitoring Recommendations

Monitor administrator sessions for anomalous activity such as unexpected privilege changes or record modifications.
Correlate Content Security Policy (CSP) violation reports to identify blocked inline script execution attempts.
Alert on new outbound network destinations from workstations used to administer the Church Donation System.

How to Mitigate CVE-2025-8167

Immediate Actions Required

Restrict administrative access to /admin/edit_members.php to trusted network ranges until a patched version is available.
Sanitize existing member records by removing HTML tags and JavaScript from stored name fields.
Enforce a strict Content Security Policy that disallows inline scripts and unauthorized external script sources.

Patch Information

No vendor patch has been referenced in the NVD data for CVE-2025-8167 at the time of publication. Operators should monitor the code-projects resource hub and the GitHub CVE issue discussion for a fixed release. Until a patch is issued, apply compensating controls at the web server and application layer.

Workarounds

Add a reverse-proxy or WAF rule that rejects requests to /admin/edit_members.php when parameters contain <, >, or javascript: sequences.
Modify the affected PHP source to wrap output of fname and related fields with htmlspecialchars($value, ENT_QUOTES, 'UTF-8') before rendering.
Require multi-factor authentication for administrator accounts to reduce the impact of session hijacking through injected scripts.

bash

# Example ModSecurity rule blocking XSS payloads to the affected endpoint
SecRule REQUEST_URI "@beginsWith /admin/edit_members.php" \
    "phase:2,chain,deny,status:403,id:1008167,\
    msg:'CVE-2025-8167 XSS attempt on edit_members.php'"
    SecRule ARGS:fname "@rx (?i)(<script|onerror=|onload=|javascript:)" \
        "t:none,t:urlDecodeUni,t:htmlEntityDecode"