A Cross-Site Request Forgery vulnerability in MuraCMS through 10.1.10 poses a significant risk by allowing unauthorized manipulation of website content and structure.

The vulnerability exists in the cTrash.restore function, which fails to perform proper CSRF token validation. This allows an attacker to force an authenticated administrator to trigger unauthorized content restoration via a crafted webpage.

Successful exploitation permits an attacker to restore deleted content to arbitrary locations within the website structure, potentially exposing sensitive documents or reintroducing malicious content to public areas. With a CVSS score of 8.8, this flaw represents a high-severity risk that can lead to significant integrity and availability impacts, including the compromise of website navigation and the restoration of content that was intentionally removed for compliance or security reasons.

Immediate Action: Update MuraCMS to version 10.1.14 or later, as documented in the vendor release notes, to ensure the cTrash.restore function implements mandatory CSRF token validation.

Proactive Monitoring: Monitor server access logs for suspicious requests to the trash restoration endpoint and investigate any unexpected modifications to the website content structure.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to inspect and block requests lacking valid CSRF tokens or identifying anomalous referer headers for administrative functions.

Public Exploit Available: Unknown

Given the high CVSS score and the potential for unauthorized content manipulation, administrators should prioritize updating to the latest version of MuraCMS immediately. Organizations unable to patch should strictly enforce secure browsing habits for administrative users and restrict access to the management console to trusted networks until a patch is applied.