PT-2009-2551 · Mybb · Mybb

Published 2009-08-25 · Updated 2025-09-26 · CVE-2008-7082

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions MyBB versions 1.4.3

Description The issue allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism, potentially hijacking the authentication of moderators. This is achieved by stealing a sensitive token, my post key, which is included in URLs to "moderation.php" with specific actions: (1) mergeposts, (2) split, and (3) deleteposts. The token can be read from the HTTP Referer header.

Recommendations For MyBB version 1.4.3, consider restricting access to the moderation.php endpoint with the mergeposts, split, and deleteposts actions until a patch is available. As a temporary workaround, avoid using the my post key parameter in the affected API endpoint to minimize the risk of exploitation.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2008-7082

Affected Products

Mybb

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2008-7082 · Security Note
• http://secunia.com/advisories/32880 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46885 · Note
• http://osvdb.org/50275 · Note
• http://securityfocus.com/archive/1/498630/100/0/threaded · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-7082 · Note
• http://securityfocus.com/bid/32467 · Note
• https://t.me/cveNotify/136638 · Telegram Post