CVE-2025-55040

{"id": "CVE-2025-55040", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2026-03-18T16:16:23.170", "references": [{"url": "https://docs.murasoftware.com/v10/release-notes/#section-version-1014", "tags": ["Release Notes"], "source": "cve@mitre.org"}, {"url": "https://www.murasoftware.com", "tags": ["Product"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "The import form CSRF vulnerability in MuraCMS through 10.1.10 allows attackers to upload and install malicious form definitions through a CSRF attack. The vulnerable cForm.importform function lacks CSRF token validation, enabling malicious websites to forge file upload requests that install attacker-controlled forms when an authenticated administrator visits a crafted webpage. Full exploitation of this vulnerability would require the victim to select a malicious ZIP file containing form definitions, which can be automatically generated by the exploit page and used to create data collection forms that steal sensitive information. Successful exploitation of the import form CSRF vulnerability could result in the installation of malicious data collection forms on the target MuraCMS website that can steal sensitive user information. When an authenticated administrator visits a malicious webpage containing the CSRF exploit and selects the attacker-generated ZIP file, their browser uploads and installs form definitions that create legitimate forms that could be designed with malicious content."}, {"lang": "es", "value": "La vulnerabilidad CSRF en el formulario de importaci\u00f3n en MuraCMS hasta la versi\u00f3n 10.1.10 permite a los atacantes cargar e instalar definiciones de formularios maliciosas a trav\u00e9s de un ataque CSRF. La funci\u00f3n vulnerable cForm.importform carece de validaci\u00f3n de token CSRF, lo que permite a sitios web maliciosos falsificar solicitudes de carga de archivos que instalan formularios controlados por el atacante cuando un administrador autenticado visita una p\u00e1gina web manipulada. La explotaci\u00f3n completa de esta vulnerabilidad requerir\u00eda que la v\u00edctima seleccione un archivo ZIP malicioso que contenga definiciones de formularios, el cual puede ser generado autom\u00e1ticamente por la p\u00e1gina del exploit y utilizado para crear formularios de recopilaci\u00f3n de datos que roban informaci\u00f3n sensible. La explotaci\u00f3n exitosa de la vulnerabilidad CSRF en el formulario de importaci\u00f3n podr\u00eda resultar en la instalaci\u00f3n de formularios de recopilaci\u00f3n de datos maliciosos en el sitio web MuraCMS objetivo que pueden robar informaci\u00f3n sensible del usuario. Cuando un administrador autenticado visita una p\u00e1gina web maliciosa que contiene el exploit CSRF y selecciona el archivo ZIP generado por el atacante, su navegador carga e instala definiciones de formularios que crean formularios leg\u00edtimos que podr\u00edan ser dise\u00f1ados con contenido malicioso."}], "lastModified": "2026-03-20T18:12:50.813", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:murasoftware:mura_cms:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CB4646EE-1255-4B42-890A-E0B57EBFE2CE"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}