RISE CRM CVE-2025-60378

Exploitation requires an authenticated RISE account with permission to create or edit invoices or send messages/chat (CVSS PR:L confirms authentication is needed-this is not unauthenticated). The injection is triggered when RISE renders the stored field into an outbound email, a generated PDF, or the messaging/chat module, so realized impact depends on a recipient opening or viewing that delivered content-a limiting factor the base vector's UI:N understates. There is no special non-default configuration required, but the amplified-risk path specifically needs the automated recurring-invoice or bulk-messaging features to be in use to reach multiple recipients. Practical limits: attacker must first obtain a valid account, and payoff hinges on social-engineering success rather than automatic technical compromise.

The supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, base 8.1) rates this High, but the C:H/I:H claim appears aggressive for what the description characterizes as HTML injection driving phishing and social-engineering rather than confirmed arbitrary script execution or direct data theft; the technical impact is largely realized through victim interaction, which the vector's UI:N omits. EPSS is low-to-moderate (1.06%, 61st percentile) and the CVE is not on CISA KEV, so there is no evidence of active exploitation; however, publicly available PoC code lowers the barrier to opportunistic abuse. Net: a real but not emergency priority-prioritize patching for internet-facing RISE instances that email invoices to external clients, but treat the 8.1 as likely inflated relative to the injection-only, interaction-dependent real-world impact. Conflict to verify with vendor: the vector states UI:N and C:H/I:H, yet the described impact (phishing, credential theft) inherently depends on recipient interaction and yields indirect rather than direct technical impact.

An attacker who holds any low-privilege RISE account (or a compromised staff/client account) creates an invoice or chat message containing crafted HTML-such as a fake 'update your payment details' login form or spoofed branding linking to a credential-harvesting page. When RISE emails the invoice, renders it as a PDF, or displays it in the client chat module, recipients see attacker-controlled content that appears to originate from the trusted business, and recurring-invoice automation redistributes it to multiple clients. A public proof-of-concept (github.com/ajansha/CVE-2025-60378) demonstrates the injection.