CVE-2025-3997: dazhouda lecms CSRF Vulnerability

CVE-2025-3997 Overview

CVE-2025-3997 is a cross-site request forgery (CSRF) vulnerability in dazhouda lecms 3.0.3. The flaw resides in the Personal Information Page component, specifically in the /index.php?my-profile-ajax-1 endpoint. An attacker can craft a malicious web page that, when visited by an authenticated lecms user, silently submits requests modifying the victim's profile data. The exploit has been publicly disclosed, increasing the likelihood of opportunistic abuse against exposed installations. The vulnerability is tracked under CWE-352: Cross-Site Request Forgery and requires user interaction for successful exploitation.

Critical Impact
Remote attackers can trick authenticated lecms users into performing unwanted profile modifications, potentially altering account-tied data without consent.

Affected Products

dazhouda lecms 3.0.3
lecms Personal Information Page component
lecms /index.php?my-profile-ajax-1 handler

Discovery Timeline

2025-04-28 - CVE-2025-3997 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-3997

Vulnerability Analysis

The vulnerability affects the AJAX handler that processes personal profile updates in lecms 3.0.3. The endpoint accepts state-changing requests without validating a per-session anti-CSRF token or verifying the request origin. An attacker who lures an authenticated user to a controlled page can trigger requests to /index.php?my-profile-ajax-1 that execute under the victim's session context. The EPSS score of 0.223% indicates a low but non-zero probability of near-term exploitation activity. Because the exploit has been publicly documented on GitHub, defenders should assume that proof-of-concept payloads are already circulating.

Root Cause

The root cause is the absence of CSRF protections on the my-profile-ajax-1 action. The handler relies solely on the presence of a valid session cookie to authorize profile changes. It does not require a unique token bound to the user session, and it does not enforce SameSite cookie attributes or strict Origin/Referer checks. This design permits cross-origin request forgery via HTML forms or automated JavaScript submissions.

Attack Vector

Exploitation requires the target user to be authenticated to a vulnerable lecms instance and to visit a page controlled by the attacker. The attacker hosts HTML that auto-submits a POST or GET request to /index.php?my-profile-ajax-1 with attacker-chosen parameters. The victim's browser attaches the lecms session cookie automatically, and the server processes the request as legitimate. No credentials or elevated privileges are needed on the attacker's side. See the public proof-of-concept on GitHub and the VulDB entry #306333 for reproduction details.

Detection Methods for CVE-2025-3997

Indicators of Compromise

Unexpected profile modifications in lecms accounts without corresponding legitimate user activity in application logs.
Web server access logs showing POST or GET requests to /index.php?my-profile-ajax-1 with Referer headers pointing to unrelated external domains.
Requests to the profile AJAX endpoint lacking a matching CSRF token parameter.

Detection Strategies

Correlate authenticated session identifiers with the Referer and Origin headers on requests to /index.php?my-profile-ajax-1 and flag cross-origin submissions.
Alert on burst patterns of profile update requests originating from a single IP or user agent that deviates from historical baselines.
Deploy a web application firewall rule that inspects requests to the profile AJAX handler and enforces same-origin policy at the proxy layer.

Monitoring Recommendations

Enable verbose HTTP request logging on the lecms web server, retaining Referer, Origin, and cookie metadata.
Ingest lecms application and access logs into a centralized analytics platform to support long-term retrospection.
Monitor for public exploit updates on the referenced VulDB advisory and adjust detections as new payload variants emerge.

How to Mitigate CVE-2025-3997

Immediate Actions Required

Restrict access to lecms administrative and authenticated user interfaces to trusted networks or VPN clients until a patched release is available.
Instruct lecms users to log out of active sessions before browsing untrusted websites.
Review recent profile changes in lecms 3.0.3 deployments and revert any unauthorized modifications.

Patch Information

No vendor patch or fixed version has been referenced in the available advisory data for lecms 3.0.3. Monitor the dazhouda lecms project and the VulDB record for updates on remediation.

Workarounds

Configure session cookies with the SameSite=Strict attribute at the web server or reverse proxy layer to block cross-site cookie transmission.
Deploy a WAF rule that rejects requests to /index.php?my-profile-ajax-1 when the Origin or Referer header does not match the application's hostname.
Add a server-side CSRF token check to the profile AJAX handler if in-house patching of the PHP source is feasible.

bash

# Example nginx snippet enforcing Origin validation on the vulnerable endpoint
location = /index.php {
    if ($arg_ != "") {
        set $csrf_check "";
    }
    if ($request_uri ~* "my-profile-ajax-1") {
        set $csrf_check "A";
    }
    if ($http_origin !~* "^https?://your-lecms-domain\.example$") {
        set $csrf_check "${csrf_check}B";
    }
    if ($csrf_check = "AB") {
        return 403;
    }
    include fastcgi_params;
    fastcgi_pass unix:/run/php/php-fpm.sock;
}