CVE-2025-55045: MuraCMS Update Address CSRF Vulnerability

CVE-2025-55045 Overview

CVE-2025-55045 is a Cross-Site Request Forgery (CSRF) vulnerability affecting MuraCMS through version 10.1.10. The vulnerability exists in the cUsers.updateAddress function, which lacks proper CSRF token validation. This security flaw allows attackers to manipulate user address information by forging malicious requests when an authenticated administrator visits a crafted webpage.

Critical Impact

Successful exploitation enables unauthorized manipulation of user address information within MuraCMS, potentially compromising user data integrity, redirecting sensitive communications to attacker-controlled locations, and facilitating social engineering attacks through corrupted address data.

Affected Products

• MuraCMS versions through 10.1.10
• MuraCMS installations with user address management functionality
• Any MuraCMS deployment where administrators access external websites while authenticated

Discovery Timeline

• 2026-03-18 - CVE-2025-55045 published to NVD
• 2026-03-19 - Last updated in NVD database

Technical Details for CVE-2025-55045

Vulnerability Analysis

This CSRF vulnerability stems from the absence of anti-CSRF token validation in the cUsers.updateAddress function within MuraCMS. When an authenticated administrator browses to a malicious webpage containing a hidden form designed to exploit this vulnerability, their browser automatically submits the forged request to the MuraCMS installation using the administrator's active session credentials.

The attack does not require any privileges from the attacker's perspective but does require user interaction—specifically, the victim administrator must visit a malicious webpage while authenticated to the target MuraCMS instance. The vulnerability can lead to significant integrity impact as attackers can modify critical user address information without proper authorization.

Root Cause

The root cause of CVE-2025-55045 is the missing CSRF token validation in the cUsers.updateAddress function. According to CWE-352 (Cross-Site Request Forgery), web applications that fail to verify that requests originate from the legitimate user are susceptible to forged cross-site requests. In this case, the function processes address modification requests without verifying the presence and validity of an anti-CSRF token, allowing external sites to forge legitimate-looking requests.

Attack Vector

The attack is network-based and requires an authenticated MuraCMS administrator to visit an attacker-controlled webpage. The exploitation flow involves:

1. The attacker crafts a malicious webpage containing a hidden HTML form targeting the vulnerable cUsers.updateAddress endpoint
2. The form is pre-populated with attacker-controlled address data including malicious email addresses and phone numbers
3. When an authenticated administrator visits this malicious page, their browser automatically submits the hidden form
4. The MuraCMS server processes the request using the administrator's valid session, treating it as a legitimate address update
5. The attacker can add malicious addresses, modify existing addresses to redirect communications, or delete legitimate address records

The vulnerability can result in misdirected sensitive communications, compromise of user privacy through injection of attacker contact information, disruption of legitimate business correspondence, and potential social engineering attacks leveraging the corrupted address data.

Detection Methods for CVE-2025-55045

Indicators of Compromise

• Unexpected modifications to user address records in the MuraCMS database without corresponding administrator activity
• Web server logs showing POST requests to address update endpoints with Referer headers from external domains
• Multiple rapid address modifications occurring within short timeframes
• New or modified addresses containing suspicious or unrecognized contact information

Detection Strategies

• Monitor MuraCMS audit logs for address modification events and correlate with administrator session activity
• Implement web application firewall (WAF) rules to detect and block requests to sensitive endpoints with suspicious Referer headers
• Review server logs for POST requests to updateAddress endpoints originating from cross-domain referrers
• Deploy SentinelOne Singularity Platform for real-time detection of CSRF exploitation attempts and anomalous web application behavior

Monitoring Recommendations

• Enable comprehensive logging for all user management functions within MuraCMS
• Configure alerts for address modifications occurring outside of normal administrative workflows
• Implement session monitoring to detect concurrent administrator sessions from disparate geographic locations
• Regularly audit user address data for unauthorized modifications or suspicious entries

How to Mitigate CVE-2025-55045

Immediate Actions Required

• Upgrade MuraCMS to version 10.14 or later, which addresses this vulnerability
• Implement network-level controls to restrict administrator access to trusted networks only
• Advise administrators to use dedicated browser profiles or sessions when accessing the MuraCMS administrative interface
• Enable SameSite cookie attributes to provide additional CSRF protection at the browser level

Patch Information

Mura Software has released version 10.14 which addresses this CSRF vulnerability. Organizations running affected versions should upgrade immediately. For detailed release information, refer to the Mura Software Version 10.14 Release Notes. Additional information is available on the Mura Software Official Website.

Workarounds

• Implement a web application firewall (WAF) with CSRF protection rules to validate request origins
• Configure strict Content Security Policy (CSP) headers to limit form submission targets
• Restrict administrative interface access to specific IP ranges or VPN connections
• Train administrators to close MuraCMS sessions before browsing external websites
• Consider implementing custom CSRF token validation at the reverse proxy level until patching is complete