CVE-2024-0545 Overview
CVE-2024-0545 is an open redirect vulnerability in Fairsketch RISE Ultimate Project Manager version 3.5.3. The flaw resides in the /index.php/signin endpoint, where the redirect parameter accepts arbitrary external URLs without validation. Attackers can craft signin links that forward authenticated users to attacker-controlled domains after login. The vulnerability is classified under CWE-601: URL Redirection to Untrusted Site. Exploitation requires no authentication or user interaction beyond clicking a malicious link. The exploit has been publicly disclosed, increasing the risk of use in phishing campaigns.
Critical Impact
Attackers can weaponize the trusted signin URL of RISE Ultimate Project Manager to redirect users to phishing sites or malware droppers, undermining user trust and enabling credential theft.
Affected Products
- Fairsketch RISE Ultimate Project Manager 3.5.3
- CodeCanyon distribution of RISE Ultimate Project Manager
- Deployments exposing /index.php/signin to untrusted networks
Discovery Timeline
- 2024-01-15 - CVE-2024-0545 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-0545
Vulnerability Analysis
The vulnerability affects the signin workflow of RISE Ultimate Project Manager, a project management application distributed via CodeCanyon. The /index.php/signin route accepts a redirect query parameter intended to return users to their original destination after authentication. The application does not validate whether the supplied URL points to an internal path or an external host. An attacker can submit a value such as http://evil.com and cause the application to forward the browser to that address. The issue is remotely exploitable over the network and requires no privileges. Publicly disclosed proof-of-concept material lowers the barrier for use in phishing kits targeting project management users.
Root Cause
The root cause is missing allowlist validation on the redirect parameter in the signin handler. The application treats the parameter as a trusted string and issues an HTTP redirect to whatever value the client provides. There is no host comparison against the application's own origin and no scheme restriction to relative paths.
Attack Vector
An attacker constructs a signin URL of the form https://victim-host/index.php/signin?redirect=http://evil.com and delivers it via email, chat, or malicious advertising. The victim sees a legitimate hostname belonging to their organization's project management portal. After authentication, the application redirects the browser to the attacker-controlled domain, which can serve a cloned login page to harvest re-entered credentials or deliver malware.
No verified exploit code is published in the referenced advisories. Technical detail is limited to the parameter name and payload pattern described in the VulDB entry #250714.
Detection Methods for CVE-2024-0545
Indicators of Compromise
- Web server access logs containing GET /index.php/signin requests with a redirect query parameter whose value begins with http:// or https:// and references an external hostname.
- Referer headers on outbound traffic showing users transitioning from the RISE signin page to unfamiliar domains.
- Phishing reports from users who clicked links pointing to the organization's RISE portal but landed on unrelated sites.
Detection Strategies
- Deploy a web application firewall rule that inspects the redirect parameter on /index.php/signin and blocks values containing absolute URLs or protocol prefixes.
- Correlate authentication events in RISE with subsequent HTTP 302 responses whose Location header points off-domain.
- Add signatures to email security gateways that flag URLs embedding redirect=http in project management portal hostnames.
Monitoring Recommendations
- Ingest web server and reverse proxy logs into a central analytics platform and alert on anomalous redirect parameter values.
- Track outbound DNS resolutions from user endpoints immediately following signin activity to identify unexpected destinations.
- Review user-reported phishing submissions for URLs that abuse legitimate RISE hostnames.
How to Mitigate CVE-2024-0545
Immediate Actions Required
- Contact Fairsketch through the CodeCanyon support channel to confirm the availability of a fixed release beyond version 3.5.3 and apply it.
- Restrict access to the RISE Ultimate Project Manager signin endpoint behind a VPN or IP allowlist where operationally feasible.
- Educate users to inspect the destination URL after authenticating and to report unexpected redirects.
Patch Information
No vendor advisory or patch URL is referenced in the NVD entry for CVE-2024-0545. Administrators should consult the VulDB entry #250714 and the CodeCanyon product page for RISE Ultimate Project Manager to obtain the latest supported release. Until a confirmed patch is applied, treat all deployments of version 3.5.3 as vulnerable.
Workarounds
- Deploy a reverse proxy or WAF rule that strips or rejects the redirect parameter on requests to /index.php/signin when the value is not a relative path.
- Modify the signin handler to validate that the redirect target resolves to the application's own hostname before issuing the HTTP 302 response.
- Configure the web server to return a default post-login landing page and ignore client-supplied redirect targets entirely.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
