CVE-2025-55744: UnoPim Vulnerable to CSRF on Product Edit and Creation Features
Summary
CVE-2025-55744: UnoPim vulnerable to CSRF on Product edit feature and creation of other types. Affects unopim/unopim versions < 0.2.1. Fixed in 0.2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
UnoPim is an open-source e-commerce platform that provides a comprehensive solution for managing online stores. It allows users to create and manage products, categories, and user settings efficiently. However, certain endpoints in UnoPim are susceptible to Cross-Site Request Forgery (CSRF) attacks, which can lead to unauthorized actions being performed on behalf of authenticated users.
Vulnerability Detail
The vulnerability arises from the absence of CSRF protection on specific endpoints, particularly those that allow state-changing actions, such as editing product details and creating categories. Attackers can exploit this weakness by tricking authenticated users into submitting requests that alter data without their consent. This can lead to unauthorized modifications of product information, creation of new categories, and other critical changes within the application.
How To Fix
Minimum fixed version
0.2.1
This is the first release that contains the fix.
composer require unopim/unopim:0.2.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement CSRF tokens for all state-changing requests manually. Ensure that each form submission includes a CSRF token in the request header. Here is an example of how to include a CSRF token in a form: <form action="/admin/catalog/products/edit/{id}" method="POST"> <input type="hidden" name="_token" value="{{ csrf_token() }}" /> ... </form>
Conclusion
The vulnerability identified as CVE-2025-55744 in the UnoPim package exposes users to CSRF attacks, allowing unauthorized actions to be performed. It is crucial to update to the patched version and implement proper CSRF protections to safeguard your application.
See every vulnerability recorded for unopim/unopim →
FAQ
Cross-Site Request Forgery (CSRF) is a type of attack that tricks a user into executing unwanted actions on a web application in which they are authenticated.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Check your application against the vulnerability using the Vulert playground at Vulert Scanner.
If exploited, attackers can perform unauthorized actions on behalf of users, potentially leading to data loss, unauthorized changes, and compromised user accounts.
Yes, the patch is available in version 0.2.1 of the UnoPim package. It is recommended to update to this version to mitigate the vulnerability.
If an immediate update is not possible, implement CSRF tokens manually for all state-changing requests as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for unopim/unopim.
