CVE-2025-41106: Fairsketch RISE CRM Framework XSS Vulnerability

CVE-2025-41106 Overview

CVE-2025-41106 is an HTML injection vulnerability affecting Fairsketch RISE CRM Framework version 3.8.1. The flaw exists in the /clients/save_contact/ endpoint, where the first_name POST parameter lacks proper input validation. Authenticated attackers can inject arbitrary HTML content that is subsequently rendered to other application users. Successful exploitation enables content spoofing, phishing lures, and user interface manipulation within the trusted CRM context. The issue is tracked under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Authenticated attackers can inject arbitrary HTML into stored contact records, enabling phishing content delivery and interface manipulation against other RISE CRM users.

Affected Products

Fairsketch RISE Ultimate Project Manager (RISE CRM Framework) version 3.8.1
Deployments exposing the /clients/save_contact/ endpoint
Self-hosted and shared tenant installations of RISE CRM

Discovery Timeline

2025-11-11 - CVE-2025-41106 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-41106

Vulnerability Analysis

The vulnerability resides in the contact creation workflow of the RISE CRM Framework. When a user submits a POST request to /clients/save_contact/, the application accepts the first_name parameter without sanitizing HTML markup. The stored value is later rendered in browser contexts without encoding, allowing injected tags to execute within the Document Object Model (DOM) of the viewing user. Because the input is persisted, every subsequent view of the affected contact record delivers the injected payload. The issue qualifies as a stored HTML injection flaw and falls within the Cross-Site Scripting (XSS) family under CWE-79.

Root Cause

The root cause is missing input validation and output encoding on the first_name field. The application trusts client-submitted data and writes it directly to persistent storage. Rendering routines then emit the stored value without context-appropriate escaping, so markup is interpreted rather than displayed as text.

Attack Vector

Exploitation requires network access to the CRM and valid low-privilege credentials. An authenticated attacker submits a crafted POST request to /clients/save_contact/ containing HTML tags in the first_name parameter. Victim interaction is required: another user must view the poisoned contact record to render the payload. Impact is limited to integrity of the user interface and does not affect confidentiality or availability of backend data.

No verified public exploitation code is available. Technical specifics are published in the INCIBE Security Notice on FairSketch CRM Vulnerabilities.

Detection Methods for CVE-2025-41106

Indicators of Compromise

POST requests to /clients/save_contact/ with HTML tags such as <img>, <a>, <iframe>, or <script> in the first_name parameter.
Contact records containing angle brackets, inline event handlers (onerror=, onload=), or encoded HTML entities in name fields.
User reports of unexpected images, hyperlinks, or layout changes when viewing specific client contacts.

Detection Strategies

Inspect web server and application logs for /clients/save_contact/ requests where parameters contain HTML metacharacters or percent-encoded equivalents (%3C, %3E).
Deploy Web Application Firewall (WAF) rules that flag or block HTML payloads submitted to CRM contact endpoints.
Run database queries against the contacts table to identify stored names containing <, >, or HTML tag patterns.

Monitoring Recommendations

Forward RISE CRM access logs to a centralized logging platform and alert on anomalous payload patterns targeting contact endpoints.
Monitor for lateral behavior following HTML injection, such as credential prompts or unexpected outbound requests from CRM user sessions.
Track authenticated session activity creating or modifying contact records at atypical volumes.

How to Mitigate CVE-2025-41106

Immediate Actions Required

Restrict access to the RISE CRM administrative interface to trusted networks or VPN until a fix is applied.
Audit existing contact records in the database for HTML markup in the first_name field and sanitize or remove malicious entries.
Review and revoke unnecessary low-privilege accounts that can access the /clients/save_contact/ endpoint.

Patch Information

No vendor patch is referenced in the current advisory data. Monitor the INCIBE Security Notice on FairSketch CRM Vulnerabilities and the Fairsketch distribution channel for an updated release addressing CVE-2025-41106. Apply the fixed version to all RISE CRM 3.8.1 deployments once published.

Workarounds

Deploy WAF rules that strip or reject HTML tags and event-handler attributes in POST parameters sent to /clients/save_contact/.
Apply a Content Security Policy (CSP) header that disallows inline scripts and restricts external resource loading in the CRM origin.
Implement server-side input validation at a reverse proxy layer to enforce an allowlist of alphabetic characters, hyphens, and spaces for name fields.

bash

# Example ModSecurity rule to block HTML in first_name on save_contact
SecRule REQUEST_URI "@endsWith /clients/save_contact/" \
    "id:1041106,phase:2,chain,deny,status:403,log,\
    msg:'CVE-2025-41106 HTML injection attempt in first_name'"
    SecRule ARGS:first_name "@rx <[^>]+>|on\w+\s*=" \
        "t:none,t:urlDecodeUni,t:htmlEntityDecode"