Multiple cross-site scripting (XSS) vulnerabilities were discovered in Church CRM v4.5.3 in GroupReports.php via GroupRole, ReportModel, and OnlyCart parameters.
**If you have the ChurchCRM software running, please file an issue using the _Report an issue_ in the help menu.**

####  On what page in the application did you find this issue?
/churchcrm/GroupReports.php
#### On what type of server is this running? Dedicated / Shared hosting?  Linux / Windows?
Linux
#### What browser (and version) are you running?
Firefox
#### What version of PHP is the server running?
7.4.33
#### What version of SQL Server are you running?
5.7.26
#### What version of ChurchCRM are you running?
4.5.3

Description:
XSS was detected in GroupReports.php, three hidden parameters were found in the code of this page, in which this vulnerability is possible: GroupRole, ReportModel, OnlyCart. A browser cannot know if the script should be trusted or not, it will execute the script in the user context allowing the attacker to access any cookies or session tokens retained by the browser.

Impact:
The vulnerability allows an attacker to send malicious JavaScript code which could result in hijacking of the user's cookie/session tokens , redirecting the user to a malicious webpage, downloading malicious files hosted on attackers server and performing many other unintended browser actions

Proof of Concept:
**<script>alert('XSS')</script>**

![1](https://user-images.githubusercontent.com/73299944/233715329-a4e3aa61-e9fe-4a2d-bbf9-5ef45fa168f2.jpg)
![2](https://user-images.githubusercontent.com/73299944/233714741-d3b8cc13-0bd9-4ab9-828c-24120e1f8577.jpg)
![3](https://user-images.githubusercontent.com/73299944/233714730-1b7d4e4b-fe6f-4716-84ac-72770f36a851.jpg)
XSS exists in the group report page
This is a GitHub Issue
repo:CRM
owner:ChurchCRM
Title : XSS exists in the group report page
Issue date:

--- start body ---
**If you have the ChurchCRM software running, please file an issue using the _Report an issue_ in the help menu.**

####  On what page in the application did you find this issue?
/churchcrm/GroupReports.php
#### On what type of server is this running? Dedicated / Shared hosting?  Linux / Windows?
Linux
#### What browser (and version) are you running?
Firefox
#### What version of PHP is the server running?
7.4.33
#### What version of SQL Server are you running?
5.7.26
#### What version of ChurchCRM are you running?
4.5.3

Description:
XSS was detected in GroupReports.php, three hidden parameters were found in the code of this page, in which this vulnerability is possible: GroupRole, ReportModel, OnlyCart. A browser cannot know if the script should be trusted or not, it will execute the script in the user context allowing the attacker to access any cookies or session tokens retained by the browser.

Impact:
The vulnerability allows an attacker to send malicious JavaScript code which could result in hijacking of the user's cookie/session tokens , redirecting the user to a malicious webpage, downloading malicious files hosted on attackers server and performing many other unintended browser actions

Proof of Concept:
**<script>alert('XSS')</script>**

![1](https://user-images.githubusercontent.com/73299944/233715329-a4e3aa61-e9fe-4a2d-bbf9-5ef45fa168f2.jpg)
![2](https://user-images.githubusercontent.com/73299944/233714741-d3b8cc13-0bd9-4ab9-828c-24120e1f8577.jpg)
![3](https://user-images.githubusercontent.com/73299944/233714730-1b7d4e4b-fe6f-4716-84ac-72770f36a851.jpg)
--- end body ---

Cross-Site Scripting (XSS) vulnerability in GroupReports.php of ChurchCRM v4.5.3 allows attackers to inject malicious JavaScript code through hidden parameters (GroupRole, ReportModel, OnlyCart). This can lead to session hijacking, redirection to malicious sites, and other unintended actions in the user's browser.