CVE-2025-41104: Fairsketch Rise Ultimate XSS Vulnerability

CVE-2025-41104 Overview

CVE-2025-41104 is an HTML injection vulnerability affecting Fairsketch RISE Ultimate Project Manager (RISE CRM Framework) version 3.8.1. The flaw exists in the /estimate_requests/save_estimate_request endpoint, where the custom_field_1 POST parameter fails to validate or sanitize user-supplied input. An authenticated attacker can inject arbitrary HTML markup into stored estimate request data. When another user renders the affected page, the injected content executes in the context of the application. The vulnerability is classified under CWE-79, covering improper neutralization of input during web page generation.

Critical Impact
Authenticated attackers can inject persistent HTML content into estimate requests, enabling phishing lures, UI redressing, and limited client-side integrity attacks against RISE CRM users.

Affected Products

Fairsketch RISE Ultimate Project Manager (RISE CRM Framework) v3.8.1
Deployments exposing the /estimate_requests/save_estimate_request endpoint
Instances accepting unvalidated custom_field_1 POST input

Discovery Timeline

2025-11-11 - CVE-2025-41104 published to the National Vulnerability Database (NVD)
2026-10-18 - Last updated in NVD database

Technical Details for CVE-2025-41104

Vulnerability Analysis

The vulnerability resides in the estimate request handler of RISE CRM Framework v3.8.1. The application accepts a POST request to /estimate_requests/save_estimate_request containing a custom_field_1 parameter. The server stores this value without applying HTML entity encoding or input validation. When the stored estimate request is later rendered in the user interface, the browser interprets the injected markup as part of the page.

Because the attack targets the client-side rendering layer, it allows an attacker to alter page structure, inject arbitrary links, or stage social engineering content inside a trusted business application. The CVSS 4.0 vector indicates that exploitation requires low privileges and user interaction, with no confidentiality or availability impact but a limited integrity impact on the subsequent system.

Root Cause

The root cause is missing output encoding and insufficient input sanitization on the custom_field_1 parameter. Custom field values intended to accept text content are passed through to the rendering layer without being filtered through an HTML escape routine. This is a textbook CWE-79 weakness manifesting in a stored context.

Attack Vector

An authenticated user submits a crafted POST request to /estimate_requests/save_estimate_request, embedding HTML tags inside the custom_field_1 form field. The payload persists in the estimate request record. When a victim views the affected estimate, the injected markup renders inside the authenticated session. The attack is network-reachable, requires low privileges, and depends on a victim interacting with the malicious record. See the INCIBE Security Notice on FairSketch CRM Vulnerabilities for the coordinated advisory.

Detection Methods for CVE-2025-41104

Indicators of Compromise

POST requests to /estimate_requests/save_estimate_request containing HTML tag characters such as <, >, <img, <script, or <iframe inside the custom_field_1 parameter.
Estimate request records whose stored custom field values contain markup, inline event handlers, or external URLs.
Unexpected outbound requests from browsers rendering estimate request pages, suggesting injected remote resources.

Detection Strategies

Inspect web server and application logs for anomalous custom_field_1 values and alert on payloads containing angle brackets or encoded equivalents (%3C, <).
Deploy web application firewall (WAF) rules targeting HTML and script tag patterns on the estimate request endpoint.
Perform periodic database audits of RISE CRM custom field tables to identify stored markup inside text fields.

Monitoring Recommendations

Monitor authenticated user activity for accounts submitting unusually large or structured custom_field_1 payloads.
Track content security policy (CSP) violation reports from browsers accessing RISE CRM pages.
Correlate estimate creation events with subsequent views by privileged users to identify potential victim exposure.

How to Mitigate CVE-2025-41104

Immediate Actions Required

Restrict access to the RISE CRM application to trusted networks or VPN users until a patched release is deployed.
Audit existing estimate request records for stored HTML content in custom_field_1 and sanitize affected entries.
Review account provisioning and revoke unused low-privilege accounts that could be leveraged for authenticated exploitation.

Patch Information

At publication, no vendor advisory URL is listed in the NVD entry for CVE-2025-41104. Administrators should consult Fairsketch directly for an updated RISE Ultimate Project Manager release addressing the custom_field_1 input validation issue, and reference the INCIBE Security Notice on FairSketch CRM Vulnerabilities for coordinated disclosure details.

Workarounds

Apply a WAF rule that rejects POST requests to /estimate_requests/save_estimate_request when custom_field_1 contains <, >, or encoded equivalents.
Enforce a strict Content Security Policy that disallows inline scripts and restricts external resource loading on RISE CRM pages.
Implement server-side HTML entity encoding on all custom field output as a temporary code-level mitigation if source modification is feasible.

bash

# Example ModSecurity rule blocking HTML tags in custom_field_1
SecRule REQUEST_URI "@streq /estimate_requests/save_estimate_request" \
  "id:1041104,phase:2,chain,deny,status:403,log,\
   msg:'CVE-2025-41104 HTML injection attempt in custom_field_1'"
  SecRule ARGS:custom_field_1 "@rx (?i)(<[a-z!/?]|%3c|<)" \
    "t:none,t:urlDecodeUni"