CVE-2025-25967 PoC — DDSN Interactive Acora CMS 跨站请求伪造漏洞

Source

https://github.com/padayali-JD/CVE-2025-25967

Associated Vulnerability

Title: DDSN Interactive Acora CMS 跨站请求伪造漏洞 (CVE-2025-25967)
Description:Acora CMS version 10.1.1 is vulnerable to Cross-Site Request Forgery (CSRF). This flaw enables attackers to trick authenticated users into performing unauthorized actions, such as account deletion or user creation, by embedding malicious requests in external content. The lack of CSRF protections allows exploitation via crafted requests.

Readme

# CVE-2025-25967: Cross-Site Request Forgery (CSRF)
DDSN Interactive cm3 Acora CMS version 10.1.1 is vulnerable to Cross-Site Request Forgery (CSRF). This flaw enables attackers to trick authenticated users into performing unauthorised actions, such as account deletion or user creation, by embedding malicious requests in external content. The lack of CSRF protections allows exploitation via crafted requests that leverage the victim's active session, leading to privilege misuse and potential disruption of user management functionality.

Affected version: Acora CMS v10.1.1 and possibly other versions

Discovered by Joby Y Daniel from Crowe India.

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →