Rise Ultimate Project Manager 1.8 Cross Site Scripting

`# Exploit Title: Rise Ultimate Project Manager - Authenticated XSS  
# Date: 2017-07-10  
# Exploit Author: 8bitsec  
# Vendor Homepage: http://rise.fairsketch.com/  
# Software Link: https://codecanyon.net/item/rise-ultimate-project-manager/15455641  
# Version: 1.8  
# Tested on: [Kali Linux 2.0 | Mac OS 10.12.5]  
# Email: [email protected]  
# Contact: https://twitter.com/_8bitsec  
  
Release Date:  
=============  
2017-07-10  
  
Product & Service Introduction:  
===============================  
RISE a Ultimate Project Manager is the best way to manage your projects, clients and team members.  
  
Vulnerability Disclosure Timeline:  
==================================  
2017-07-07: Found the vulnerabilities.  
2017-07-07: Reported to vendor.  
2017-07-10: No response.  
2017-07-10: Published.  
  
Technical Details & Description:  
================================  
  
Multiple authenticated XSS vulnerabilities found logged as a client user.  
  
Proof of Concept (PoC):  
=======================  
  
Authenticated XSS:  
  
My Profile > All input fields are vulnerable.  
The payload is triggered when entering My Profile or Users section.  
  
Authenticated XSS:  
  
Messaging > Send Message. Subject and Message fields are vulnerable.  
Payload executes when reading the message.  
  
Credits & Authors:  
==================  
8bitsec - [https://twitter.com/_8bitsec]  
`