CVE-2025-25967: Ddsn Acora CMS CSRF Vulnerability

CVE-2025-25967 Overview

CVE-2025-25967 is a Cross-Site Request Forgery (CSRF) vulnerability affecting Acora CMS version 10.1.1. The flaw allows attackers to trick authenticated users into executing unauthorized actions within the application. Exploitation can lead to account deletion, unauthorized user creation, or other state-changing operations on behalf of the victim. The vulnerability exists because the application does not implement CSRF protections such as anti-CSRF tokens on sensitive endpoints. An attacker can embed crafted requests in external content and rely on user interaction to trigger them.

Critical Impact
Authenticated administrators visiting attacker-controlled content can have their sessions abused to create, modify, or delete CMS users without their consent.

Affected Products

Acora CMS 10.1.1
Vendor: ddsn
CWE-352: Cross-Site Request Forgery

Discovery Timeline

2025-03-03 - CVE-2025-25967 published to NVD
2025-03-06 - Last updated in NVD database

Technical Details for CVE-2025-25967

Vulnerability Analysis

The vulnerability stems from missing CSRF protections on state-changing endpoints within Acora CMS 10.1.1. The application relies on session cookies to authenticate administrative actions but does not validate that requests originated from a trusted page. An attacker who lures an authenticated administrator to a malicious site can submit forged HTTP requests that the CMS processes as legitimate. The classification under [CWE-352] reflects the absence of synchronizer tokens, double-submit cookies, or SameSite cookie enforcement on privileged operations.

Because attacks require user interaction such as clicking a link or loading attacker-controlled content, the exploitation path depends on social engineering. Once triggered, the forged request executes with the privileges of the victim's active session.

Root Cause

The CMS administrative endpoints accept POST and GET requests without verifying a per-session CSRF token. There is no Origin or Referer header validation enforced on sensitive operations such as user creation and deletion. Browsers automatically attach session cookies to these cross-origin requests, allowing the server to treat them as authorized.

Attack Vector

Exploitation proceeds over the network and requires an authenticated administrative session. An attacker hosts a malicious page containing an auto-submitting HTML form or image tag that targets the Acora CMS administrative endpoint. When the victim visits the page while logged in, the browser issues the forged request with valid session cookies. The CMS processes the request and performs the requested action, such as deleting an account or provisioning a new privileged user.

A public proof-of-concept is available in the GitHub PoC Repository demonstrating the request structure required to exploit the missing CSRF controls.

Detection Methods for CVE-2025-25967

Indicators of Compromise

Unexpected administrator account creation or deletion events in Acora CMS audit logs.
HTTP requests to administrative endpoints with Referer headers pointing to external or unknown domains.
POST requests to user management endpoints missing expected CSRF token parameters.

Detection Strategies

Inspect web server logs for state-changing requests with cross-origin Referer or Origin headers.
Correlate administrative actions with user browsing telemetry to identify requests not initiated from the CMS interface.
Alert on bursts of user create or delete operations occurring outside of normal administrative workflows.

Monitoring Recommendations

Enable detailed audit logging for all privileged actions in Acora CMS and forward logs to a centralized SIEM.
Monitor for repeated failed or anomalous administrative requests originating from a single session.
Track browser referrer patterns when administrators access the CMS to baseline legitimate access flows.

How to Mitigate CVE-2025-25967

Immediate Actions Required

Restrict administrative access to Acora CMS using IP allow-listing or VPN-only access.
Require administrators to log out of CMS sessions when not in active use and avoid concurrent browsing.
Review the audit log for unauthorized user creation, deletion, or permission changes.

Patch Information

No vendor advisory or patched version has been published in the available data. Contact ddsn directly to obtain remediation guidance for Acora CMS 10.1.1. Refer to the GitHub PoC Repository for technical details on the affected endpoints.

Workarounds

Deploy a web application firewall rule to validate Origin and Referer headers on administrative endpoints.
Configure session cookies with SameSite=Strict to prevent cross-site cookie transmission where possible.
Educate administrators to avoid clicking untrusted links while authenticated to the CMS.
Use a separate browser or browser profile for CMS administration to isolate session cookies.

bash

# Example nginx configuration to block requests with foreign Referer to admin paths
location /admin/ {
    if ($http_referer !~* "^https?://cms\.example\.com/") {
        return 403;
    }
    proxy_pass http://acora_backend;
}