Executive brief
Emlog is an open-source website building system. A security flaw in the administrative dashboard allows an attacker to execute malicious scripts in the browser of a logged-in administrator. If an administrator clicks a specially crafted link, the attacker could steal their login session, access sensitive user data, or perform unauthorized administrative actions.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in the admin user management search functionality (admin/user.php). The 'keyword' GET parameter is processed using addslashes(), which escapes quotes for SQL safety but fails to neutralize HTML special characters. This value is then directly rendered into the 'value' attribute of an input tag in admin/views/user.php without HTML encoding. An attacker can bypass the addslashes() protection by using characters like '>' to break out of the attribute and inject arbitrary script tags. Successful exploitation requires an authenticated administrator to click a malicious URL, potentially leading to session hijacking via cookie theft. No official patch has been identified, though manual remediation via htmlspecialchars() is recommended.
Affected products
- Emlog Emlog Pro <= 2.6.13
Timeline
- 2026-05-13: advisory: GitHub Security Advisory published by vendor
- 2026-07-16: disclosed: CVE published to NVD dataset