Church Donation System CVE-2025-8167

Exploitation requires: (1) valid administrative credentials to access /admin/edit_members.php (authenticated access, PR:L), (2) a target administrator to click a crafted link or visit the malicious page (user interaction, UI:P), and (3) the fname parameter must be rendered in the response without HTML encoding. The vulnerability is contingent on the application being accessible over the network (AV:N) and does NOT require non-default configuration-it affects the default administrative interface. Exploitation is NOT automatable; an attacker cannot remotely trigger the XSS without user interaction from an authenticated admin.

Real-world risk is LOW despite public exploit availability. Multiple signals converge on this assessment: CVSS score of 2.0 reflects minimal confidentiality, integrity, and availability impact (VC:N/VI:L/VA:N); EPSS 0.05% (16th percentile) indicates negligible exploitation probability; attack requires authenticated admin access (PR:L) plus user interaction (UI:P), creating dual friction. The public POC exists but has not reached CISA KEV status, suggesting no confirmed active exploitation in the wild. The attack is non-automatable-it requires an admin to manually click a link or visit a crafted page. For most deployments, this represents a lower priority than network-accessible, unauthenticated vulnerabilities, though it should not be ignored in environments where admin accounts are heavily used or shared.

An attacker with valid Church Donation System admin credentials crafts a malicious URL containing JavaScript in the fname parameter (e.g., /admin/edit_members.php?fname=<script>alert('XSS')</script>), then tricks another administrator into clicking the link or visits the page directly if session hijacking is possible. When the target admin loads the page, the injected script executes in their browser, potentially allowing the attacker to steal session cookies, exfiltrate member data, or modify donation records.