CVE-2008-7082
MyBB 1.4.3 - Cross-Site Request Forgery via my_post_key Parameter in Moderation Actions
Title source: llmDescription
MyBB (aka MyBulletinBoard) 1.4.3 includes the sensitive my_post_key parameter in URLs to moderation.php with the (1) mergeposts, (2) split, and (3) deleteposts actions, which allows remote attackers to steal the token and bypass the cross-site request forgery (CSRF) protection mechanism to hijack the authentication of moderators by reading the token from the HTTP Referer header.
References (5)
Core 5
Core References
Third Party Advisory, VDB Entry mailing-list
x_refsource_bugtraq
http://www.securityfocus.com/archive/1/498630/100/0/threaded
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/32467
Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/32880
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/46885
Third Party Advisory, VDB Entry vdb-entry
x_refsource_osvdb
http://osvdb.org/50275
Scores
EPSS
0.0060
EPSS Percentile
44.4%
Details
CWE
CWE-352
Status
published
Products (1)
mybb/mybb
1.4.3
Published
Aug 25, 2009
Tracked Since
Feb 18, 2026