UnoPim vulnerable to CSRF on Product edit feature and creation of other types
Date: 2025-08
Affected: composer/unopim/unopim
Attack vector: other
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2025-55744
CWE: CWE-352

### Summary Some of the endpoints of the application is vulnerable to Cross site Request forgery (CSRF). | Method | Endpoint | Status | Reason | |:------:|:------:|:------:|:------:| | POST | /admin/catalog/products/create | Not Vulnerable :white_check_mark: | `X-XSRF-TOKEN` header used | | GET | /admin/catalog/products/copy/{id}| Vulnerable :x: | Missing `X-XSRF-TOKEN` header or similar protection | | POST | /admin/catalog/products/edit/{id}| Vulnerable :x: | Missing `X-XSRF-TOKEN` header or similar protection | | POST | /admin/settings/users/create | Not Vulnerable :white_check_mark: | `X-XSRF-TOKEN` header used | The below are some of the vulnerable endpoints that allow state changing actions including but not limited to: ``` /admin/catalog/categories/create /admin/catalog/categories/edit/{id} /admin/catalog/category-fields/create /admin/catalog/category-fields/edit/{id} /admin/catalog/attributes/create /admin/catalog/attributes/edit/{id} ``` ### Details CSRF attack happens when you visit an attacker controlled website which sends a cross origin request to vulnerable application in order to perform a state changing operation like edit the price of a product without the intention of victim. In this case, the POST request doesn't need any special headers ( X-XSRF-TOKEN header missing ) and the content-type is either `application/x-www-form-urlencoded` or `multipart/form-data` so we can say this is a `Simple request` ( doesn't need preflight request ). The cookies are se


Mitigations:

Architectural layers (MAESTRO):