CVE-2008-7214 Cross-site request forgery (CSRF) vulnerability in administrator/index2.php in MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allows remote attackers to hijack the authentication of administ...
MediumCVSS 6.8
EPSS 0.75%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site request forgery (CSRF) vulnerability in administrator/index2.php in MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allows remote attackers to hijack the authentication of administrators for requests that add new administrator accounts via the save task in a com_users action, as demonstrated using a separate XSS vulnerability in mambots/editors/mostlyce/jscripts/tiny_mce/filemanager/connectors/php/connector.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mambo-foundation mambo | <= 4.6.3 | No fix listed |
| mambo-foundation mambo | = 4.6.2 | No fix listed |
| brilaps mostlyce | <= 2.0 | No fix listed |
References
- 20080227 Re: Mambo 4.6.3 Path Disclosure, XSS , XSRF, DOS mailing-list
- forum.mambo-foundation.org
- 42531 exploit vdb-entry
- 28670 third-party-advisory vendor-advisory
- www.bugreport.ir exploit
- 20080128 Mambo 4.6.3 Path Disclosure, XSS , XSRF, DOS mailing-list
- ADV-2008-0325 vdb-entry vendor-advisory
- mambo-connector-csrf(39985) vdb-entry