A CSRF vulnerability in MuraCMS allows attackers to force authenticated administrators to install malicious data collection forms, leading to potential sensitive information theft.

The cForm.importform function lacks necessary CSRF token validation. This allows an attacker to trick an authenticated administrator into uploading and installing malicious ZIP files containing form definitions via a crafted webpage.

Successful exploitation allows an attacker to deploy malicious data collection forms on the target website. This can lead to the theft of sensitive user data submitted through these forms, resulting in significant privacy breaches and potential regulatory non-compliance. With a CVSS score of 8.8, this vulnerability represents a high risk to the confidentiality and integrity of the application.

Immediate Action: Update MuraCMS to version 10.1.14 or higher, as noted in the vendor release documentation.

Proactive Monitoring: Review application access logs for unusual import requests or unexpected form installations originating from the administrative interface.

Compensating Controls: Implement strict Referer header validation and ensure that administrative sessions are protected by robust CSRF protection mechanisms until the patch is applied.

Public Exploit Available: Unknown.

Given the potential for unauthorized data collection and the high CVSS severity rating, organizations utilizing MuraCMS should prioritize upgrading to version 10.1.14 immediately. Administrators should also exercise caution when browsing external websites while logged into the MuraCMS administrative portal to minimize exposure to CSRF-based attacks.