Emlog vulnerabilities

Emlog is an open source website building system. Prior to version 2.6.11, missing CSRF protection in critical admin functions allowed attackers to trick authenticated administrators into performing unauthorized actions like system registration, plugin management, and configuration changes.

Emlog, an open source website building system, version 2.6.1 and earlier exposes a REST API endpoint (/index.php?rest-api=upload) for media file uploads. The endpoint fails to implement proper validation of file types, extensions, and content, allowing authenticated attackers (with a valid API key or admin session cookie) to upload arbitrary files (including malicious PHP scripts) to the server. An attacker can obtain the API key either by gaining administrator access or via information disclosure vulnerabilities. Once uploaded, the malicious PHP file can be executed to gain remote code execution (RCE) on the target server, leading to full server compromise.

Emlog is an open source website building system. Versions up to and including 2.5.19 are vulnerable to server-side Out-of-Band (OOB) requests / SSRF via uploaded SVG files. An attacker can upload a crafted SVG containing external resource references, causing the server to issue an HTTP request to an attacker-controlled host when processing the file.

Emlog version 2.6.26 and earlier allows unauthenticated reinstallation (action=reinstall) in install.php, which skips the already-installed check. An attacker can overwrite config.php and create a new administrator account.

Emlog is an open source website building system. Prior to version 2.6.11, direct SQL injection in article creation and update functions allowed attackers to execute arbitrary SQL commands.

Emlog version 2.5.23 has a CSRF vulnerability in article creation functionality. This can lead to a user being forced to post an article with arbitrary, attacker-controlled content. When combined with stored XSS, it leads to account takeover.

In Emlog, an open source website building system, in versions 2.6.29 and prior, tag names are not HTML-encoded when rendered in the article editor. An attacker can create a tag containing ');alert(document.domain);//. The addslashes() function does not escape HTML entities, so ' is stored as-is. When the browser renders the page, it decodes ' back to a literal single quote before evaluating the JavaScript, breaking out of the string and executing arbitrary code. At time of publication, there are no publicly known patches.

Emlog versions 2.6.29 and prior process article content with Parsedown without enabling safe mode, allowing raw HTML including <script> tags to pass through unescaped. This results in stored XSS visible to all site visitors.

Emlog up to version 2.6.29 has a vulnerability in the emUnZip() function, which extracts ZIP entries without validating paths for ../ traversal sequences. An attacker can overwrite arbitrary files on the server, including config.php, leading to immediate remote code execution (RCE). At the time of publication, there are no publicly known patches.

Emlog before version 2.6.16 has a blind SQL injection vulnerability in User_Model::getUserDataByLogin(). The $account parameter is directly interpolated into SQL queries without any filtering. The vulnerability is reachable through the auth cookie validation path, where $username is extracted from the cookie and passed unfiltered into SQL — guarded only by an HMAC signature that requires AUTH_KEY to forge.

Emlog is an open source website building system. In 2.6.20 and earlier, there is a SQL injection vulnerability in the queryDatabase function in ai.php.

Missing CSRF protection in the execute_tool action in admin/ai.php in Emlog 2.6.26 and earlier allows a remote unauthenticated attacker to submit a forged request to a logged-in administrator. The attack can read all database tables and write to all tables except blog, including taking over an administrator account.

In Emlog version 2.6.13 and earlier, the article publishing interface stores a path-traversal template parameter from api_controller.php without validation, and log_controller.php later checks file_exists and calls include View::getView($template), allowing an authenticated author to include an arbitrary local .php file when an article is viewed.

In Emlog version 2.6.13 and earlier, the 'keyword' parameter in the admin user search module is processed with addslashes but not HTML-escaped before being rendered into the value attribute in admin/views/user.php, allowing reflected XSS in an administrator's backend session.

A SQL injection vulnerability was found in Emlog version 2.6.2 and earlier in the updateTagName() function in include/model/tag_model.php. The function directly interpolates user input into SQL queries without parameterized queries, allowing SQL injection attacks.

In Emlog version 2.6.2 and earlier, a Local File Inclusion (LFI) vulnerability exists in admin/plugin.php. The $plugin parameter from the GET request is directly used in a require_once path without proper sanitization. If the CSRF token check can be bypassed, an attacker can include arbitrary PHP files from the server filesystem, leading to code execution.

In Emlog versions 2.6.2 and prior, a path traversal vulnerability exists in the emUnZip() function, allowing an authenticated admin to write arbitrary files (including PHP webshells) by extracting a crafted ZIP archive with ../ sequences, leading to Remote Code Execution (RCE). No public patch available.

Emlog prior to version 2.6.8 has a stored XSS vulnerability in the comment module via URI scheme validation bypass. Attackers can inject malicious scripts that execute when the comment page is viewed.

Emlog prior to version 2.6.8 contains a vulnerability in the backend upgrade interface that accepts remote SQL and ZIP URLs via GET parameters. The server downloads and executes the SQL file, then downloads the ZIP file and extracts it directly into the web root. The process does not validate a CSRF token, so an attacker can trick an authenticated administrator into visiting a malicious link, leading to arbitrary SQL execution and file write.

emlog version 2.1.9 is vulnerable to arbitrary file deletion via admin emplate.php.