CVE-2025-41102: Fairsketch Rise CRM XSS Vulnerability

CVE-2025-41102 Overview

CVE-2025-41102 is an HTML injection vulnerability in Fairsketch's RISE Ultimate Project Manager (RISE CRM Framework) version 3.8.1. The flaw resides in the /events/save endpoint, where the title parameter processed from a POST request lacks proper input validation and output encoding. An authenticated attacker can inject arbitrary HTML markup that is later rendered in the application interface. This maps to CWE-79, Improper Neutralization of Input During Web Page Generation. The Spanish National Cybersecurity Institute (INCIBE) coordinated the public disclosure.

Critical Impact
Authenticated users can inject HTML into stored event records, enabling content spoofing, phishing lures, and potential client-side attacks against other RISE CRM users.

Affected Products

Fairsketch RISE Ultimate Project Manager (RISE CRM Framework) v3.8.1
Deployments exposing the /events/save endpoint to authenticated users
Self-hosted and shared tenants running the vulnerable release

Discovery Timeline

2025-11-11 - CVE-2025-41102 published to NVD
2026-10-18 - Last updated in NVD database

Technical Details for CVE-2025-41102

Vulnerability Analysis

RISE CRM accepts event metadata through the /events/save route, which persists records such as calendar entries used across the project management workspace. The title parameter is written to storage and later reflected in HTML responses without neutralizing markup characters. An attacker with a low-privileged account can submit a crafted POST request containing HTML tags in the title field. When another user views the event listing or detail view, the injected markup is rendered as part of the page. The flaw is a stored HTML injection impacting integrity rather than confidentiality, and exploitation requires a victim to interact with the affected view.

Root Cause

The root cause is missing server-side input validation and missing output encoding on the title field. The application treats user-supplied text as trusted markup when generating HTML responses. There is no allow-list of permitted characters, no HTML entity encoding at render time, and no Content Security Policy strict enough to neutralize injected elements. This matches the CWE-79 pattern for stored cross-site content injection.

Attack Vector

Exploitation requires network access to the RISE CRM web interface and valid low-privileged credentials. The attacker sends a POST request to /events/save with the title parameter populated with HTML markup, for example anchor tags redirecting to an attacker-controlled domain, iframes, or form elements. The server stores the payload. When any authenticated user loads the events view, the browser renders the attacker's markup inline. See the INCIBE Security Notice on Fairsketch CRM Vulnerabilities for additional technical context.

Detection Methods for CVE-2025-41102

Indicators of Compromise

POST requests to /events/save containing HTML tags such as <a>, <iframe>, <form>, or <img> within the title parameter.
Event records in the RISE CRM database whose title column contains angle brackets or HTML entities.
Outbound navigation from the events view to unexpected external domains following user interaction with injected links.

Detection Strategies

Review web server and application logs for POST requests to /events/save where the title parameter length or character set deviates from expected plain-text values.
Run database queries against the events table to identify stored titles containing <, >, javascript:, or on*= attributes.
Deploy a web application firewall rule that inspects form fields on /events/save for HTML markup patterns.

Monitoring Recommendations

Alert on anomalous event-creation volume from a single authenticated account, which may indicate payload testing.
Monitor browser-side error reports and CSP violation reports originating from event listing pages.
Track user complaints or helpdesk tickets referencing unexpected links or page content within the CRM events module.

How to Mitigate CVE-2025-41102

Immediate Actions Required

Restrict access to the RISE CRM instance to trusted networks or VPN-only reach until a patched release is deployed.
Audit the events table for malicious markup and sanitize or remove offending records.
Review user accounts and revoke credentials that are no longer required to reduce the authenticated attack surface.

Patch Information

At the time of publication, no vendor advisory or fixed version has been linked in the NVD record for CVE-2025-41102. Administrators should monitor Fairsketch release notes and the INCIBE Security Notice on Fairsketch CRM Vulnerabilities for updated remediation guidance and apply any security release above v3.8.1 as soon as it becomes available.

Workarounds

Deploy a reverse-proxy or WAF rule that rejects POST requests to /events/save when the title field contains <, >, or script-related keywords.
Enforce a strict Content Security Policy that disables inline scripts and restricts frame and form targets.
Train CRM users to avoid clicking unexpected links inside event entries and to report suspicious content.

bash

# Example ModSecurity rule to block HTML markup in the title parameter
SecRule REQUEST_URI "@streq /events/save" \
    "id:1041102,phase:2,deny,status:400,msg:'CVE-2025-41102 HTML injection attempt',\
    chain"
    SecRule ARGS:title "@rx <[a-zA-Z/!]" "t:none,t:lowercase"