EUVD-2025-208827Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
The import form CSRF vulnerability in MuraCMS through 10.1.10 allows attackers to upload and install malicious form definitions through a CSRF attack. The vulnerable cForm.importform function lacks CSRF token validation, enabling malicious websites to forge file upload requests that install attacker-controlled forms when an authenticated administrator visits a crafted webpage. Full exploitation of this vulnerability would require the victim to select a malicious ZIP file containing form definitions, which can be automatically generated by the exploit page and used to create data collection forms that steal sensitive information. Successful exploitation of the import form CSRF vulnerability could result in the installation of malicious data collection forms on the target MuraCMS website that can steal sensitive user information. When an authenticated administrator visits a malicious webpage containing the CSRF exploit and selects the attacker-generated ZIP file, their browser uploads and installs form definitions that create legitimate forms that could be designed with malicious content.
AnalysisAI
MuraCMS versions through 10.1.10 contain a Cross-Site Request Forgery (CSRF) vulnerability in the cForm.importform function that lacks proper token validation, allowing attackers to deceive authenticated administrators into uploading and installing malicious form definitions. An attacker can craft a malicious webpage that, when visited by an authenticated MuraCMS administrator, automatically generates and submits a forged file upload request containing a ZIP archive with attacker-controlled form definitions. Successful exploitation results in the installation of data-harvesting forms on the target website that can steal sensitive user information collected through legitimate-appearing web forms. No active exploitation in the wild has been documented (KEV status unknown), and no formal CVSS score has been assigned, though the vulnerability requires user interaction (administrator must visit the malicious page) which moderates the overall risk profile.
Technical ContextAI
The vulnerability exists in the cForm component of MuraCMS, a content management system used for building web applications and data collection portals. The root cause is classified under CSRF (Cross-Site Request Forgery) and improper file upload handling—specifically, the importform function fails to validate CSRF tokens before processing file uploads containing form definition packages. MuraCMS uses a form import mechanism that accepts ZIP files containing serialized form configuration data; this mechanism is exposed to CSRF attacks because the endpoint does not implement proper token validation or same-origin policy enforcement. The affected product is identified as MuraCMS (vendor: Mura Software, though CPE data in the intelligence feed shows generic placeholders rather than specific vendor/product identifiers), impacting versions up to and including 10.1.10. The vulnerability class falls under CWE-352 (Cross-Site Request Forgery) combined with insecure file upload practices.
RemediationAI
Upgrade MuraCMS immediately to version 10.1.4 or later, as confirmed by the vendor release notes at https://docs.murasoftware.com/v10/release-notes/#section-version-1014. Until patching is completed, implement the following compensating controls: restrict administrative access to MuraCMS to trusted IP addresses via firewall or reverse proxy rules; educate administrators to avoid visiting untrusted websites while authenticated to MuraCMS and to never import form definition files from unknown sources; implement Content Security Policy (CSP) headers with 'X-Frame-Options: DENY' to mitigate clickjacking attacks that could bundle the CSRF payload; enable CSRF token validation in the application configuration if available as a feature flag. Additionally, monitor form import logs for suspicious ZIP files containing unexpected form definitions and audit the form library regularly for unauthorized additions.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today