CVE-2024-8945: Rise Ultimate Project Manager SQLi Flaw

CVE-2024-8945 Overview

CVE-2024-8945 is a SQL injection vulnerability in CodeCanyon RISE Ultimate Project Manager version 3.7.0, developed by Fairsketch. The flaw resides in the /index.php/dashboard/save endpoint, where the id parameter is not properly sanitized before being used in a database query. Authenticated remote attackers can manipulate the parameter to inject arbitrary SQL statements. The vulnerability is tracked under CWE-89: Improper Neutralization of Special Elements used in an SQL Command. Public disclosure has occurred and the exploit details are available, increasing the likelihood of opportunistic exploitation against exposed instances.

Critical Impact
An authenticated attacker can inject SQL statements through the id parameter of the dashboard save endpoint, leading to unauthorized read or write access against the RISE CRM database.

Affected Products

Fairsketch RISE Ultimate Project Manager 3.7.0
CodeCanyon distribution of RISE CRM (RISE Ultimate Project Manager)
Deployments exposing /index.php/dashboard/save to untrusted networks

Discovery Timeline

2024-09-17 - CVE-2024-8945 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-8945

Vulnerability Analysis

The vulnerability affects the dashboard save handler at /index.php/dashboard/save in RISE Ultimate Project Manager 3.7.0. The id request argument is passed into a backend SQL query without proper parameterization or input filtering. An authenticated user can supply crafted SQL syntax through this parameter to alter the intended query structure. Depending on the underlying query, attackers may extract sensitive data such as user credentials, project records, and client information, or modify persisted data. The EPSS score indicates a notably higher-than-average likelihood of exploitation attempts compared to the broader CVE population, consistent with the availability of public technical details in the Bytium SQL Injection Advisory.

Root Cause

The root cause is improper neutralization of user-controlled input in the id parameter before it reaches the SQL layer [CWE-89]. The affected code path in dashboard/save concatenates request data into a query string rather than using prepared statements or a parameterized query interface. Missing type enforcement on the id parameter, which should represent an integer identifier, allows non-numeric SQL payloads to reach the database engine.

Attack Vector

The attack is delivered over the network against the CRM web interface. The attacker submits a crafted HTTP request to /index.php/dashboard/save containing SQL metacharacters in the id field. Because low-privileged authentication is required, any user account with dashboard access, including self-registered or tenant-shared accounts in multi-user deployments, can trigger the vulnerability. Successful injection allows UNION-based data extraction, boolean-based blind extraction, or stacked query execution depending on the driver configuration.

No verified proof-of-concept code has been published to this article. Refer to the Bytium advisory and VulDB entry 277762 for technical write-ups.

Detection Methods for CVE-2024-8945

Indicators of Compromise

HTTP requests to /index.php/dashboard/save containing SQL keywords such as UNION, SELECT, SLEEP, --, or /* in the id parameter.
Unexpected non-numeric values submitted in the id field of dashboard save requests.
Database errors or unusually long response times originating from the RISE CRM application logs.
Sudden spikes in outbound data transfer from the CRM database host following authenticated dashboard activity.

Detection Strategies

Deploy a web application firewall (WAF) rule that inspects POST bodies to /index.php/dashboard/save and blocks SQL metacharacters in the id parameter.
Correlate authenticated web session activity with database query anomalies to identify injection attempts by low-privileged accounts.
Enable verbose SQL error logging in staging environments to surface malformed queries indicative of probing.

Monitoring Recommendations

Forward RISE CRM web server logs and MySQL/MariaDB query logs to a central analytics pipeline for correlation.
Alert on repeated 500-series responses from /index.php/dashboard/* endpoints, which often accompany SQL injection probing.
Track authentication events preceding dashboard save requests to attribute injection attempts to specific accounts.

How to Mitigate CVE-2024-8945

Immediate Actions Required

Upgrade RISE Ultimate Project Manager beyond version 3.7.0 to a release that addresses the SQL injection in dashboard/save.
Restrict network exposure of the RISE CRM instance to trusted networks or place it behind a VPN.
Rotate database credentials and audit application user accounts for signs of misuse if the endpoint has been exposed publicly.
Review database contents for unauthorized modifications to project, client, and user tables.

Patch Information

The vendor advisory recommends upgrading the affected component. No fixed version identifier is included in the NVD record at time of publication. Consult the Bytium advisory and the CodeCanyon product listing for Fairsketch RISE Ultimate Project Manager for the current patched release.

Workarounds

Apply a WAF virtual patch that rejects requests to /index.php/dashboard/save when the id parameter is not a positive integer.
Enforce least-privilege database accounts for the CRM so that injected queries cannot access unrelated schemas.
Disable or restrict low-privileged user accounts that do not require dashboard write access until an upgrade is applied.
Enable database query logging and review logs daily until the patched version is deployed.

bash

# Example nginx rule: reject non-numeric 'id' values submitted to dashboard/save
location /index.php/dashboard/save {
    if ($request_method = POST) {
        set $bad 0;
        if ($request_body ~* "(^|&)id=[^0-9&]") { set $bad 1; }
        if ($bad = 1) { return 403; }
    }
    include fastcgi_params;
    fastcgi_pass unix:/run/php/php-fpm.sock;
}