Emlog vulnerabilities

Emlog is an open source website building system. Prior to version 2.6.11, missing CSRF protection in critical admin functions allowed attackers to trick authenticated administrators into performing unauthorized actions like system registration, plugin management, and configuration changes.

Emlog, an open source website building system, version 2.6.1 and earlier exposes a REST API endpoint (/index.php?rest-api=upload) for media file uploads. The endpoint fails to implement proper validation of file types, extensions, and content, allowing authenticated attackers (with a valid API key or admin session cookie) to upload arbitrary files (including malicious PHP scripts) to the server. An attacker can obtain the API key either by gaining administrator access or via information disclosure vulnerabilities. Once uploaded, the malicious PHP file can be executed to gain remote code execution (RCE) on the target server, leading to full server compromise.

Emlog is an open source website building system. Versions up to and including 2.5.19 are vulnerable to server-side Out-of-Band (OOB) requests / SSRF via uploaded SVG files. An attacker can upload a crafted SVG containing external resource references, causing the server to issue an HTTP request to an attacker-controlled host when processing the file.

Emlog version 2.6.26 and earlier allows unauthenticated reinstallation (action=reinstall) in install.php, which skips the already-installed check. An attacker can overwrite config.php and create a new administrator account.

Emlog is an open source website building system. Prior to version 2.6.11, direct SQL injection in article creation and update functions allowed attackers to execute arbitrary SQL commands.

Emlog version 2.5.23 has a CSRF vulnerability in article creation functionality. This can lead to a user being forced to post an article with arbitrary, attacker-controlled content. When combined with stored XSS, it leads to account takeover.

Emlog is an open source website building system. In 2.6.20 and earlier, there is a SQL injection vulnerability in the queryDatabase function in ai.php.

Missing CSRF protection in the execute_tool action in admin/ai.php in Emlog 2.6.26 and earlier allows a remote unauthenticated attacker to submit a forged request to a logged-in administrator. The attack can read all database tables and write to all tables except blog, including taking over an administrator account.

In Emlog version 2.6.13 and earlier, the article publishing interface stores a path-traversal template parameter from api_controller.php without validation, and log_controller.php later checks file_exists and calls include View::getView($template), allowing an authenticated author to include an arbitrary local .php file when an article is viewed.

In Emlog version 2.6.13 and earlier, the 'keyword' parameter in the admin user search module is processed with addslashes but not HTML-escaped before being rendered into the value attribute in admin/views/user.php, allowing reflected XSS in an administrator's backend session.

A SQL injection vulnerability was found in Emlog version 2.6.2 and earlier in the updateTagName() function in include/model/tag_model.php. The function directly interpolates user input into SQL queries without parameterized queries, allowing SQL injection attacks.

In Emlog version 2.6.2 and earlier, a Local File Inclusion (LFI) vulnerability exists in admin/plugin.php. The $plugin parameter from the GET request is directly used in a require_once path without proper sanitization. If the CSRF token check can be bypassed, an attacker can include arbitrary PHP files from the server filesystem, leading to code execution.

In Emlog versions 2.6.2 and prior, a path traversal vulnerability exists in the emUnZip() function, allowing an authenticated admin to write arbitrary files (including PHP webshells) by extracting a crafted ZIP archive with ../ sequences, leading to Remote Code Execution (RCE). No public patch available.

Emlog prior to version 2.6.8 has a stored XSS vulnerability in the comment module via URI scheme validation bypass. Attackers can inject malicious scripts that execute when the comment page is viewed.

Emlog prior to version 2.6.8 contains a vulnerability in the backend upgrade interface that accepts remote SQL and ZIP URLs via GET parameters. The server downloads and executes the SQL file, then downloads the ZIP file and extracts it directly into the web root. The process does not validate a CSRF token, so an attacker can trick an authenticated administrator into visiting a malicious link, leading to arbitrary SQL execution and file write.

emlog version 2.1.9 is vulnerable to arbitrary file deletion via admin emplate.php.