CVE-2008-7214

Cross-site request forgery (CSRF) vulnerability in administrator/index2.php in MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allows remote attackers to hijack the authentication of administrators for requests that add new administrator accounts via the save task in a com_users action, as demonstrated using a separate XSS vulnerability in mambots/editors/mostlyce/jscripts/tiny_mce/filemanager/connectors/php/connector.php.

• CWE-352

• http://archives.neohapsis.com/archives/bugtraq/2008-02/0444.html
• http://forum.mambo-foundation.org/showthread.php?t=10158
• http://osvdb.org/42531Exploit
• http://secunia.com/advisories/28670Vendor Advisory
• http://www.bugreport.ir/index_33.htmExploit
• http://www.securityfocus.com/archive/1/487128/100/200/threaded
• http://www.vupen.com/english/advisories/2008/0325Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/39985
• http://archives.neohapsis.com/archives/bugtraq/2008-02/0444.html
• http://forum.mambo-foundation.org/showthread.php?t=10158
• http://osvdb.org/42531Exploit
• http://secunia.com/advisories/28670Vendor Advisory
• http://www.bugreport.ir/index_33.htmExploit
• http://www.securityfocus.com/archive/1/487128/100/200/threaded
• http://www.vupen.com/english/advisories/2008/0325Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/39985

Published

Sep 11, 2009

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2008-7208Multiple SQL injection vulnerabilities in OneCMS 2.4, and po…
• CVE-2008-7209Unrestricted file upload vulnerability in the add2 action in…
• CVE-2008-7210directory.php in AJchat 0.10 allows remote attackers to bypa…
• CVE-2008-7211CreativeLabs es1371mp.sys 5.1.3612.0 WDM audio driver, as us…
• CVE-2008-7212MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, all…
• CVE-2008-7213Cross-site scripting (XSS) vulnerability in mambots/editors/…
• CVE-2008-7215The Image Manager in MOStlyCE before 2.4, as used in Mambo 4…
• CVE-2008-7216Peter's Math Anti-Spam Spinoff plugin for WordPress generate…
• CVE-2008-7217Microsoft Office 2008 for Mac, when running on Macintosh sys…
• CVE-2008-7218Unspecified vulnerability in the Horde API in Horde 3.1 befo…
• CVE-2008-7219Horde Kronolith H3 2.1 before 2.1.7 and 2.2 before 2.2-RC2; …
• CVE-2008-7220Unspecified vulnerability in Prototype JavaScript framework …