Executive brief
FairSketch Rise CRM is a project management and customer relationship management (CRM) platform used by organizations to track projects and client interactions. A vulnerability in version 3.9.6 allows authenticated administrators to inject malicious JavaScript code into item titles, which is then executed in the browsers of client users viewing the store page. This can lead to session hijacking, account takeover, and phishing attacks against all client users who access affected items.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in the item title field of FairSketch Rise CRM versions up to 3.9.6. An authenticated administrator can inject arbitrary JavaScript payload (e.g., <img src=x onerror=alert(document.cookie)>) via the /index.php/items edit interface, which is persisted server-side. When any authenticated client user navigates to /index.php/store to view items, the malicious script executes in their browser context with their privileges. This allows an attacker to exfiltrate session cookies, perform unauthorized actions, or redirect users to phishing pages. The vulnerability was fixed in version 4.0 through input validation. The attack requires an authenticated admin account but affects all client users who view the store.
Affected products
- FairSketch Rise CRM <=3.9.6
Timeline
- 2026-02-24: disclosed: Reported to vendor via CodeCanyon support
- 2026-02-25: other: Vendor acknowledged
- 2026-05-05: other: CVE-2026-36392 assigned by MITRE
- 2026-07-23: patched: Fixed in version 4.0
- 2026-09-07: disclosed: Public disclosure