EUVD-2025-208834Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
MuraCMS through 10.1.10 contains a CSRF vulnerability that allows attackers to permanently destroy all deleted content stored in the trash system through a simple CSRF attack. The vulnerable cTrash.empty function lacks CSRF token validation, enabling malicious websites to forge requests that irreversibly delete all trashed content when an authenticated administrator visits a crated webpage. Successful exploitation of the CSRF vulnerability results in potentially catastrophic data loss within the MuraCMS system. When an authenticated administrator visits a malicious page containing the CSRF exploit, their browser automatically submits a hidden form that permanently empties the entire trash system without any validation, confirmation dialog, or user consent.
AnalysisAI
MuraCMS versions through 10.1.10 contain a Cross-Site Request Forgery (CSRF) vulnerability in the cTrash.empty function that lacks proper token validation, allowing attackers to permanently delete all content in the trash system. An authenticated administrator visiting a malicious webpage can be tricked into permanently destroying all deleted content without their knowledge or consent, resulting in catastrophic, irreversible data loss. While no CVSS score or EPSS data is currently available, the vulnerability's attack vector is network-based with low complexity, affecting any authenticated administrator, and the technical impact of complete data destruction in the trash system constitutes a critical business continuity threat.
Technical ContextAI
The vulnerability exists in MuraCMS, a content management system, specifically within the cTrash.empty function which handles deletion of trashed content. The root cause is a missing CSRF token validation mechanism (CWE-352: Cross-Site Request Forgery), a common web application flaw where state-changing operations lack proper origin verification. When an administrator is authenticated to the MuraCMS system, their browser maintains an active session. An attacker can craft a malicious webpage containing a hidden form or JavaScript that automatically submits a request to the trash emptying endpoint. Without CSRF token validation, the server accepts the forged request as legitimate because it originates from an authenticated user's browser session, regardless of whether the user actually intended to perform the action. The affected products include MuraCMS through version 10.1.10, as indicated by the vendor documentation reference to version 10.1.4 release notes.
RemediationAI
Immediately upgrade MuraCMS to a version later than 10.1.10 that includes CSRF token validation fixes in the cTrash.empty function; consult https://www.murasoftware.com and https://docs.murasoftware.com/v10/release-notes/#section-version-1014 for the latest patched release. Until patching is possible, implement compensating controls by restricting administrative backend access to specific IP ranges or through a VPN, enforcing Content Security Policy (CSP) headers to prevent loading of external malicious content, and implementing SameSite cookie attributes set to 'Strict' to prevent cross-site cookie transmission. Additionally, educate administrators about phishing risks and malicious webpage visits, and consider implementing administrative user activity logging and monitoring for trash.empty function calls to detect exploitation attempts. If available, apply any interim security patches released by Mura Software before a full version upgrade can be executed.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today