Yourls version1 .7 suffers from a persistent cross site scripting vulnerability.
2c2e8735cb469e954aa3a2db523f33bac49da92babbff3f7d23aad9ae98e9735
Hello, I found a xss stored vulnerability in Yourls 1.7 script (latest
version).
The attacker can steal the admin's cookies and login in the admin panel.
Note: Only the admin can see this.
Steps to perform the vulnerability:
1. Create a new url to shorten --> In the inputs you need write this
payload --> anything"><img src=x onerror=prompt(1)>*
* Javascript code to inject.
2. Click in the button "Shorten"
3. Wait until the administrator logs in the admin panel
Screenshoots:
1. http://i.imgur.com/G4r6uV0.png
2. http://i.imgur.com/jhGR4n2.png
3. http://i.imgur.com/gQYSqgt.png
Thank You, Kind Regards.