YOURLS 1.8.2 - Cross-Site Request Forgery (CSRF)
Source Exploit-DB RSS Feed
Rated by Threat Radar
Data as of 30 Dec 2025, 22:16 UTC
What to do
AI-suggested
To mitigate this CSRF vulnerability, organizations should first check for and apply any available updates or patches from the YOURLS project that address CSRF protections. Employ Content Security Policy (CSP) headers to restrict the sources of executable scripts and reduce the risk of malicious site interactions. Encourage users to log out of YOURLS sessions when not in use and educate them about the risks of visiting untrusted websites while authenticated. Consider deploying web application firewalls (WAFs) with rules to detect and block CSRF attack patterns. Additionally, review and harden session management policies, including setting secure, HttpOnly cookies and limiting session lifetimes. For organizations with development resources, consider contributing patches or custom fixes to the YOURLS codebase to enforce CSRF protections. Regularly audit and monitor YOURLS logs for suspicious activities indicative of CSRF exploitation attempts.
Description
YOURLS 1.8.2 - Cross-Site Request Forgery (CSRF)
Indicators of compromise
Exploit source code
# Exploit Title: YOURLS 1.8.2 - Cross-Site Request Forgery (CSRF)
# Date: 2025-11-25
# Exploit Author: CodeSecLab
# Vendor Homepage: https://github.com/yourls/yourls/
# Software Link: https://github.com/yourls/yourls/
# Version: 1.8.2
# Tested on: Windows
# CVE : CVE-2022-0088
Proof Of Concept
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta http-equiv="X-UA-Compatible" content="IE=edge">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
…