CVE-2008-7214

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2009-09-11 · updated 2026-06-16
Weakness: CWE-352

Description

Cross-site request forgery (CSRF) vulnerability in administrator/index2.php in MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allows remote attackers to hijack the authentication of administrators for requests that add new administrator accounts via the save task in a com_users action, as demonstrated using a separate XSS vulnerability in mambots/editors/mostlyce/jscripts/tiny_mce/filemanager/connectors/php/connector.php.

Affected products

Brilaps Mostlyce: through 2.0
Mambo-Foundation Mambo: through 4.6.3; 4.6.2

References

http://archives.neohapsis.com/archives/bugtraq/2008-02/0444.html
http://forum.mambo-foundation.org/showthread.php?t=10158
http://osvdb.org/42531
http://secunia.com/advisories/28670
http://www.bugreport.ir/index_33.htm
http://www.securityfocus.com/archive/1/487128/100/200/threaded
http://www.vupen.com/english/advisories/2008/0325
https://exchange.xforce.ibmcloud.com/vulnerabilities/39985
http://archives.neohapsis.com/archives/bugtraq/2008-02/0444.html
http://forum.mambo-foundation.org/showthread.php?t=10158
http://osvdb.org/42531
http://secunia.com/advisories/28670

Get alerted when CVE-2008-7214 or the next vulnerability affects your stack