Executive Summary

This vulnerability exists in MuraCMS through version 10.1.10 and is a Cross-Site Request Forgery (CSRF) issue. It allows attackers to permanently delete all content stored in the trash system without the administrator's consent. The vulnerable function, cTrash.empty, does not validate CSRF tokens, which means a malicious website can trick an authenticated administrator into submitting a hidden form that empties the trash system automatically when they visit the malicious page.

Useful 0 Not Useful 0

Impact Analysis

The impact of this vulnerability is potentially catastrophic data loss within the MuraCMS system. An attacker can cause all deleted content in the trash system to be permanently erased without any confirmation or user consent, which could result in loss of important data that might have been intended for recovery.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

I don't know

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this CSRF vulnerability in MuraCMS, immediate steps should focus on preventing unauthorized requests that empty the trash system.

• Restrict administrator access to trusted networks and devices to reduce exposure to malicious websites.
• Advise administrators to avoid visiting untrusted or suspicious websites while logged into the MuraCMS administrative interface.
• Implement or enforce CSRF token validation in the cTrash.empty function to ensure requests are legitimate.
• Regularly back up all content, including trashed items, to enable recovery in case of accidental or malicious deletion.

Useful 0 Not Useful 0