-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| yourls/yourls | composer | <= 1.10.2 |
Miggo AIRoot Cause AnalysisThe vulnerability exists in the handling of JSONP callback parameters in YOURLS. The entry point for the vulnerability is yourls-api.php, which reads the callback or jsonp parameter from the user's request. This unsanitized input is then passed to the yourls_api_output function in includes/functions-api.php. The yourls_api_output function, prior to the patch, would directly concatenate this user-provided string into the response, leading to a Cross-Site Scripting (XSS) vulnerability. The provided patch b1c6100e0aa6fef58c9c1a394ccc19352c3a480a confirms this by adding a validation step using the new yourls_validate_jsonp_callback function within yourls_api_output before the callback is used. Therefore, yourls_api_output is the function where the vulnerability is triggered.
yourls_api_outputincludes/functions-api.php