CVE-2025-55045 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the updateAddress function in MuraCMS versions through 10.1.10. The core issue is the absence of CSRF token validation in the cUsers.updateAddress function, which enables attackers to craft malicious web pages that, when visited by an authenticated administrator, cause the browser to submit forged requests without the administrator's explicit consent. These forged requests can add new addresses with attacker-controlled contact information, modify existing addresses to redirect communications, or delete legitimate address records. The impact of this vulnerability is significant because it compromises the integrity of user address data, potentially leading to misdirected sensitive communications, privacy breaches, and disruption of legitimate business correspondence. Attackers can leverage this to inject malicious contact details, facilitating social engineering or phishing attacks. The vulnerability requires user interaction in the form of an administrator visiting a malicious webpage but does not require elevated privileges beyond administrator authentication. The CVSS v3.1 score is 7.1 (high), reflecting the network attack vector, low attack complexity, no privileges required, but user interaction needed, with low confidentiality impact but high integrity impact and no availability impact. No patches or known exploits are currently reported, but the vulnerability's nature suggests it could be exploited in targeted attacks against organizations using MuraCMS. The CWE-352 classification confirms the CSRF nature of the flaw.

The exploitation of CVE-2025-55045 can have several adverse effects on organizations worldwide using MuraCMS. Unauthorized manipulation of user address information can lead to misdirected sensitive communications, such as invoices, legal notices, or confidential correspondence, potentially causing financial loss or legal exposure. Injected attacker-controlled contact details can facilitate social engineering or phishing attacks, increasing the risk of credential theft or further compromise. Deletion of legitimate address records can disrupt business operations by causing communication failures or delays. The integrity of organizational data is directly affected, undermining trust in the system and potentially damaging the organization's reputation. Since the vulnerability requires an authenticated administrator to visit a malicious webpage, targeted spear-phishing campaigns could be used to exploit this flaw. Organizations with high reliance on MuraCMS for managing user or customer contact information are particularly at risk. Although availability is not impacted, the confidentiality impact is low but not negligible due to potential indirect data exposure through social engineering. Overall, the threat could facilitate broader attacks by undermining communication channels and enabling attacker persistence or escalation.

To mitigate CVE-2025-55045 effectively, organizations should first verify if their MuraCMS deployment is at or below version 10.1.10 and apply any available patches or updates from the vendor as soon as they are released. In the absence of official patches, administrators should implement strict Content Security Policy (CSP) headers to restrict the domains from which scripts and forms can be loaded, reducing the risk of CSRF attacks. Additionally, enabling SameSite cookies with 'Strict' or 'Lax' attributes can help prevent cross-origin requests from being sent with authentication cookies. Administrators should be trained to avoid visiting untrusted or suspicious websites while logged into MuraCMS. Network-level protections such as web application firewalls (WAFs) can be configured to detect and block suspicious POST requests to the updateAddress endpoint. Implementing multi-factor authentication (MFA) for administrator accounts can reduce the risk of account compromise, indirectly mitigating exploitation risk. Finally, monitoring and alerting on unexpected changes to user address data can help detect exploitation attempts early. Organizations should also review and harden their internal processes for managing user data to limit the impact of any unauthorized changes.