CVE-2025-41103: Fairsketch Rise Ultimate XSS Vulnerability

CVE-2025-41103 Overview

CVE-2025-41103 is an HTML injection vulnerability in Fairsketch RISE Ultimate Project Manager (RISE CRM Framework) version 3.8.1. The flaw exists in the /messages/reply endpoint, which fails to properly validate or sanitize user-supplied input in the reply_message POST parameter. An authenticated attacker can inject arbitrary HTML markup that renders in the browser of any user who views the message thread. The issue is tracked under CWE-79 (Improper Neutralization of Input During Web Page Generation). The vulnerability was disclosed through an INCIBE Notice on FairSketch Vulnerabilities.

Critical Impact
Authenticated attackers can inject arbitrary HTML into internal messages, enabling phishing content, UI redressing, and credential harvesting against RISE CRM users.

Affected Products

Fairsketch RISE Ultimate Project Manager (RISE CRM Framework) v3.8.1
Earlier RISE CRM Framework v3.x releases sharing the vulnerable /messages/reply handler
Deployments exposing the messaging module to authenticated internal or external users

Discovery Timeline

2025-11-11 - CVE-2025-41103 published to NVD
2026-10-18 - Last updated in NVD database

Technical Details for CVE-2025-41103

Vulnerability Analysis

The vulnerability resides in the message reply workflow of RISE CRM. When a user submits a POST request to /messages/reply, the application accepts the reply_message parameter and persists its contents without stripping or encoding HTML markup. The stored content is later rendered in the recipient's browser context, allowing injected tags such as <iframe>, <form>, <a>, and <img> to execute as part of the page markup.

Because RISE CRM handles client, project, and staff communications, injected content reaches trusted internal users. Attackers can abuse this trust to display fake login prompts, embed external resources, or redirect victims to attacker-controlled infrastructure. User interaction is required to view the malicious message, which aligns with the CVSS 4.0 UI:P metric.

Root Cause

The root cause is missing output encoding and insufficient server-side validation of the reply_message field. The application treats message bodies as HTML-capable content without applying a sanitization allowlist, violating standard neutralization practices described in CWE-79.

Attack Vector

An attacker with low-privileged authenticated access sends a crafted POST request to /messages/reply containing HTML payloads in reply_message. The payload persists in the conversation and renders when any recipient opens the thread. See the INCIBE Notice on FairSketch Vulnerabilities for additional technical context.

Detection Methods for CVE-2025-41103

Indicators of Compromise

POST requests to /messages/reply containing HTML tags such as <iframe>, <form>, <script>, or <a href= inside the reply_message parameter.
Message records in the RISE CRM database with embedded external URLs, inline styles, or encoded HTML entities not produced by the native editor.
Outbound user navigation from the messaging module to unexpected external domains after opening internal replies.

Detection Strategies

Inspect web server and application logs for POST bodies to /messages/reply containing angle brackets, javascript: URIs, or base64 data URIs.
Deploy a Web Application Firewall (WAF) rule to flag HTML markup in parameters expected to carry plain text message bodies.
Perform periodic database audits of stored messages to identify records containing raw HTML tags inconsistent with the application's rich-text output.

Monitoring Recommendations

Alert on sudden spikes of 302 or external redirects originating from authenticated RISE CRM sessions.
Monitor browser Content Security Policy (CSP) violation reports from users accessing the messaging module.
Correlate authentication events with message submissions to identify low-privileged accounts generating atypical message content.

How to Mitigate CVE-2025-41103

Immediate Actions Required

Restrict access to the RISE CRM messaging module to trusted authenticated users only, pending a vendor patch.
Deploy a WAF rule that rejects or strips HTML tags from the reply_message parameter in requests to /messages/reply.
Audit existing stored messages for malicious HTML and purge any records containing injected markup.

Patch Information

No vendor patch is referenced in the NVD entry at the time of publication. Administrators should monitor the Fairsketch RISE product page and the INCIBE Notice on FairSketch Vulnerabilities for update availability and apply any released fix for versions after 3.8.1.

Workarounds

Enforce a strict Content Security Policy that disallows inline scripts, inline event handlers, and external frames on RISE CRM pages.
Apply server-side HTML sanitization libraries (such as HTMLPurifier) to the reply_message field before persistence and rendering.
Train users to report unexpected forms, links, or embedded content in internal CRM messages and avoid interacting with them.

bash

# Example ModSecurity rule to block HTML tags in reply_message
SecRule ARGS:reply_message "@rx <[a-zA-Z/!]" \
    "id:1041103,phase:2,deny,status:403,\
    msg:'CVE-2025-41103 - HTML injection attempt in RISE CRM reply_message',\
    logdata:'Matched payload: %{MATCHED_VAR}'"