FairSketch RISE CRM 3.7.0 SQL Injection Vulnerability and PoC

From this webpage screenshot, the following key information about the vulnerability can be extracted: 1. Vulnerability Description: - Title: FairSketch RISE - Ultimate Project Manager & CRM 3.7.0 SQL Injection - Description: A critical SQL injection vulnerability has been discovered in RISE CRM version 3.7.0. The vulnerability requires the attacker to be authenticated as a client; however, if the user/client registration feature is enabled, exploitation becomes easier. The flaw arises from improper sanitization of user input in the parameter at the endpoint, allowing attackers to inject SQL commands. This could lead to data leakage, unauthorized database access, or full compromise of the application. The issue has been fixed in version 3.7.1. 2. Exploitation: - PoC Example: An example of an SQL injection payload is provided for the parameter. - Payload: , which successfully returns a true condition and generates a valid response. 3. Request Headers: - POST Request: - Host: - Content-Length: - Accept: - User-Agent: - Content-Type: - Origin: - Referer: - Cookie: - Connection: This information provides a detailed overview of the vulnerability’s nature, exploitation method, and associated HTTP request headers, aiding in understanding its severity and how it can be exploited.

Goal Reached Thanks to every supporter — we hit 100%!

FairSketch RISE CRM 3.7.0 SQL Injection Vulnerability and PoC