Executive brief
Emlog is an open-source website building system. An SQL injection vulnerability in the queryDatabase function (admin/ai.php) allows authenticated admin users to bypass input validation and execute arbitrary SQL commands. This could lead to unauthorized access to the entire database, theft of sensitive data including user credentials, or complete database destruction.
Technical details
The vulnerability is a SQL injection flaw in the queryDatabase() function within admin/ai.php (lines 112-143). The function accepts user-supplied SQL via POST parameter 'params' and executes it against the database with insufficient input validation. Although the code attempts to restrict queries to read-only operations (SELECT/SHOW/DESC/DESCRIBE/EXPLAIN) and block certain keywords, these restrictions can be bypassed using encoding or query stacking techniques. Exploitation requires admin authentication and network access to the admin interface. A successful attack allows an attacker to execute arbitrary SQL commands, potentially exfiltrating sensitive data (usernames, password hashes), reading arbitrary database tables, or modifying/deleting data. No patch has been released for v2.6.20 and earlier.
Affected products
- Emlog Emlog 2.6.20 and earlier
Timeline
- 2026-08-01: disclosed: GitHub security advisory GHSA-jffg-rpvp-2qx7 published
- 2026-08-14: advisory: CVE-2026-73850 published on NVD