CVE-2008-7082

EUVD-2008-7041
MyBB (aka MyBulletinBoard) 1.4.3 includes the sensitive my_post_key parameter in URLs to moderation.php with the (1) mergeposts, (2) split, and (3) deleteposts actions, which allows remote attackers to steal the token and bypass the cross-site request forgery (CSRF) protection mechanism to hijack the authentication of moderators by reading the token from the HTTP Referer header.
CSRF
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.8 UNKNOWN
NETWORK
MEDIUM
AV:N/AC:M/Au:N/C:P/I:P/A:P
Base Score
CVSS 3.x
EPSS Score
Percentile: 28%
Affected Products (NVD)
VendorProductVersion
mybbmybb
1.4.3
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://osvdb.org/50275
http://secunia.com/advisories/32880
http://www.securityfocus.com/archive/1/498630/100/0/threaded
http://www.securityfocus.com/bid/32467
https://exchange.xforce.ibmcloud.com/vulnerabilities/46885
http://osvdb.org/50275
http://secunia.com/advisories/32880
http://www.securityfocus.com/archive/1/498630/100/0/threaded
http://www.securityfocus.com/bid/32467
https://exchange.xforce.ibmcloud.com/vulnerabilities/46885