CVE-2025-55045 Overview
CVE-2025-55045 is a Cross-Site Request Forgery (CSRF) vulnerability affecting MuraCMS through version 10.1.10. The flaw resides in the cUsers.updateAddress function, which lacks CSRF token validation. Attackers can craft malicious webpages that forge requests to add, modify, or delete user address records when an authenticated administrator visits the page. Successful exploitation allows attackers to inject attacker-controlled email addresses and phone numbers, redirect business communications, or delete legitimate address entries. The vulnerability is classified under [CWE-352] (Cross-Site Request Forgery).
Critical Impact
Authenticated administrators visiting a malicious page can have user address records silently modified, leading to communication hijacking, data integrity loss, and follow-on social engineering attacks.
Affected Products
- Mura Software MuraCMS versions through 10.1.10
- Mura Software MuraCMS releases prior to version 10.14
- Deployments using the cUsers.updateAddress function without CSRF protection
Discovery Timeline
- 2026-03-18 - CVE-2025-55045 published to the National Vulnerability Database
- 2026-03-20 - Last updated in NVD database
Technical Details for CVE-2025-55045
Vulnerability Analysis
The vulnerability stems from missing CSRF token validation in the address update workflow of MuraCMS. The cUsers.updateAddress function accepts state-changing requests without verifying that the request originated from a legitimate, user-initiated form submission. Attackers exploit this gap by hosting a malicious page that auto-submits a hidden form to the target MuraCMS instance. The administrator's browser includes valid session cookies, and the server processes the forged request as authentic.
The impact extends beyond simple data tampering. Attackers can inject contact records containing adversary-controlled email addresses and phone numbers. They can also overwrite existing addresses to reroute correspondence or delete records outright to disrupt business operations.
Root Cause
The root cause is the absence of anti-CSRF tokens, origin validation, or SameSite cookie restrictions on the address update endpoint. State-changing operations rely solely on the presence of an authenticated session cookie. This pattern matches the [CWE-352] classification for missing request authenticity verification.
Attack Vector
Exploitation requires user interaction. The attacker lures an authenticated MuraCMS administrator to a controlled webpage through phishing, malvertising, or a compromised site. The page contains a hidden HTML form targeting the vulnerable endpoint, and JavaScript triggers automatic submission. No credentials are needed by the attacker because the victim's browser supplies the session automatically.
No proof-of-concept code has been published. See the Mura Software Release Notes for vendor remediation details.
Detection Methods for CVE-2025-55045
Indicators of Compromise
- Unexpected modifications, additions, or deletions in user address records within MuraCMS administrative logs
- HTTP POST requests to cUsers.updateAddress with Referer or Origin headers pointing to external domains
- Address entries containing email domains or phone numbers inconsistent with established user data
Detection Strategies
- Inspect web server access logs for state-changing requests to the address update endpoint that originate from cross-site referrers
- Correlate administrator session activity with browser navigation events to identify forced submissions following external page visits
- Audit MuraCMS user address tables for sudden changes against historical baselines
Monitoring Recommendations
- Enable verbose logging on MuraCMS administrative actions, capturing source IP, referrer, and timestamp for every address modification
- Alert on changes to multiple address records within short time windows by a single administrator session
- Monitor outbound communications for delivery to newly added contact records to flag rerouted correspondence
How to Mitigate CVE-2025-55045
Immediate Actions Required
- Upgrade MuraCMS to version 10.14 or later, which addresses the CSRF flaw
- Restrict administrative access to MuraCMS to trusted networks or VPN-only ranges
- Require administrators to use dedicated browser profiles or sessions when accessing the CMS
Patch Information
Mura Software addressed the issue in version 10.14. Review the Mura Software Version 10.14 Release notes for upgrade procedures and verify that the cUsers.updateAddress function enforces CSRF token validation after the update.
Workarounds
- Configure session cookies with SameSite=Strict or SameSite=Lax to block cross-site cookie transmission on state-changing requests
- Deploy a web application firewall rule that rejects requests to cUsers.updateAddress lacking a same-origin Referer or Origin header
- Train administrators to log out of MuraCMS sessions before browsing external sites and to avoid clicking untrusted links while authenticated
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
