MuraCMS versions through 10.1.10 are vulnerable to a Cross-Site Request Forgery attack that can result in catastrophic data loss by bypassing administrative trash management controls.

The vulnerability exists in the cTrash.empty function, which fails to implement necessary CSRF token validation. An attacker can force an authenticated administrator to execute an irreversible deletion of all trashed content by simply visiting a crafted webpage.

The exploitation of this vulnerability leads to the permanent, unauthorized destruction of data stored within the trash system. Given the CVSS score of 8.1, this flaw poses a high risk to data integrity and availability. Successful exploitation could lead to significant operational disruption and the loss of critical business information that was intended to be recoverable.

Immediate Action: Update MuraCMS to version 10.1.14 or later, as documented in the vendor release notes, to implement the required CSRF token validation.

Proactive Monitoring: Monitor server access logs for anomalous requests to the cTrash.empty endpoint originating from unexpected referrers or external domains.

Compensating Controls: Deploy a Web Application Firewall (WAF) to inspect incoming traffic and block requests that lack proper CSRF tokens or originate from suspicious sources.

Public Exploit Available: Unknown

This vulnerability represents a significant risk to data retention policies and system integrity. Administrators should prioritize upgrading to the patched version immediately to ensure that trash management functions are protected against unauthorized forged requests. Failure to remediate this issue leaves the application susceptible to irreversible data destruction triggered by simple social engineering.