CVE-2025-25928

HIGH

OpenMRS 2.4.3 - Cross-Site Request Forgery in User Form Endpoint

Title source: llm

Description

A Cross-Site Request Forgery (CSRF) in the component /admin/users/user.form of Openmrs 2.4.3 Build 0ff0ed allows attackers to execute arbitrary operations via a crafted request. In this case, an attacker could elevate a low-privileged account to an administrative role by leveraging the CSRF vulnerability at the /admin/users/user.form endpoint.

References (1)

Core 1

Core References

Exploit

https://github.com/johnchd/CVEs/blob/main/OpenMRS/CVE-2025-25928%20-%20CSRF%20PrivEsc.md

View Exploit ZIP pw:eip

Scores

CVSS v3 8.0

EPSS 0.0027

EPSS Percentile 17.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact total

Details

CWE

CWE-352

Status published

Products (1)

openmrs/openmrs 2.4.3

Published Mar 11, 2025

Tracked Since Feb 18, 2026