Description

1. Hi there YOURLS team, I would like to report a Cross Site Request forgery vulenrability on YOURLS. Cross-site request forgery (also known as CSRF) is a web security vulnerability that allows an attacker to induce users to perform actions that they do not intend to perform. It allows an attacker to partly circumvent the same origin policy, which is designed to prevent different websites from interfering with each other.
2. In case of YOURLS, this CSRF allows a hacker to trick user to logout of yourls.

Proof of Concept

1. Install a local instace of YOURLS
2. Access this link: admin/index.php?action=logout
3. See that you are logged out of yourls.
4. In the real attack scenario, the hacker would feed this URL to the targeted user, and when they click the links, they are automatically logged out of YOURLS

Impact

This vulnerability is capable of CSRF.