CVE:CVE-2008-7214
CNNVD:CNNVD-200909-229
MOStlyCE 2.4版本之前的版本的administrator/index2.php中存在跨站请求伪造漏洞。当在Mambo 4.6.3版本及其早期版本中运行时,远程攻击者可以借助一个com_users操作中的保存任务，例如运行mambots/editors/mostlyce/jscripts/tiny_mce/filemanager/connectors/php/connector.php中独立的跨站脚本攻击漏洞，劫持管理员认证权限并要求添加新的管理员帐号。
solution:Upgrade mambo-foundation mambo to a higher version than 4.6.3,4.6.2,and avoid the version (,4.6.3],4.6.2; Upgrade brilaps mostlyce to a higher version than 2.0,and avoid the version (,2.0]