EUVD-2025-208832Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
The Trash Restore CSRF vulnerability in MuraCMS through 10.1.10 allows attackers to restore deleted content from the trash to unauthorized locations through CSRF. The vulnerable cTrash.restore function lacks CSRF token validation, enabling malicious websites to forge requests that restore content to arbitrary parent locations when an authenticated administrator visits a crafted webpage. Successful exploitation of the Trash Restore CSRF vulnerability results in unauthorized restoration of deleted content to potentially inappropriate or malicious locations within the MuraCMS website structure. When an authenticated administrator visits a malicious webpage containing the CSRF exploit, their browser automatically submits a hidden form that restores specified content from the trash to a location determined by the attacker through the parentid parameter. This can lead to restoration of previously deleted malicious content, placement of sensitive documents in public areas, manipulation of website navigation structure, or restoration of outdated content that was intentionally removed for security or compliance reasons.
AnalysisAI
A Cross-Site Request Forgery (CSRF) vulnerability exists in the cTrash.restore function of MuraCMS through version 10.1.10, which lacks CSRF token validation. An authenticated administrator can be tricked into restoring deleted content to arbitrary locations within the CMS by visiting a malicious webpage, enabling attackers to resurrect malicious or sensitive content, manipulate website structure, or restore intentionally-removed materials. No CVSS score, EPSS data, or known exploits-in-the-wild confirmation are available at this time, though the vulnerability is documented as requiring user interaction (an admin must visit a crafted page) and authenticated session context.
Technical ContextAI
The vulnerability resides in the cTrash.restore function within MuraCMS, a web content management system. The root cause is improper CSRF protection (CWE category: Cross-Site Request Forgery), specifically the absence of CSRF token validation on state-changing restore operations. When an administrator is authenticated to MuraCMS and visits an attacker-controlled webpage, that page can silently submit a hidden form to the vulnerable restore endpoint, leveraging the administrator's active session to authorize the restore action. The attacker manipulates the 'parentid' parameter to specify an unauthorized destination for restored content. MuraCMS is identified through the CPE namespace (cpe:2.3:a:n/a:n/a:*:*:*:*:*:*:*:*), though vendor-specific CPE refinement is unavailable in current records. The vulnerability affects MuraCMS versions up to and including 10.1.10.
RemediationAI
Upgrade MuraCMS to version 10.1.11 or later as soon as possible; consult https://docs.murasoftware.com/v10/release-notes/ for patched version availability and installation instructions. Until an upgrade window is available, apply the following compensating controls: enforce HTTPS with HSTS headers to prevent man-in-the-middle interception of session tokens, implement Content Security Policy (CSP) headers to restrict cross-origin form submissions, educate administrators to avoid clicking links from untrusted sources while logged into the CMS, and consider restricting CMS access to a allowlist of trusted IP ranges using a reverse proxy or WAF. Verify that CSRF token generation and validation are enabled for all state-changing functions once patched.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today