MuraCMS CSRF Vulnerability Allowing Permanent Deletion of Trashed Content

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in MuraCMS versions through 10.1.10. This vulnerability allows attackers to permanently delete all content in the trash system by exploiting the cTrash.empty function, which lacks proper CSRF token validation. When an authenticated administrator visits a crafted webpage, their browser automatically submits a hidden form that empties the trash without any validation or user consent. The exploitation of this vulnerability could lead to significant data loss within the MuraCMS system.

Impact

Exploitation of this vulnerability results in irreversible deletion of all trashed content, causing potentially catastrophic data loss in the MuraCMS system.