Emlog is an open source website building system. In versions up to and including 2.5.9, SQL injection occurs because the $origContent parameter in admin/article_save.php is not strictly filtered. Since admin/article_save.php can be accessed by ordinary registered users, this will cause SQL injection to occur when the registered site is enabled, resulting in the injection of the admin account and password, which is then exploited by the backend remote code execution. As of time of publication, it is unknown whether a fix exists.
References
| Link | Resource |
|---|---|
| https://github.com/emlog/emlog/security/advisories/GHSA-939m-47f7-m559 | Exploit Vendor Advisory |
| https://github.com/emlog/emlog/security/advisories/GHSA-939m-47f7-m559 | Exploit Vendor Advisory |
Configurations
History
12 Jun 2025, 16:39
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.8 |
| First Time |
Emlog emlog
Emlog |
|
| CPE | cpe:2.3:a:emlog:emlog:*:*:*:*:pro:*:*:* | |
| References | () https://github.com/emlog/emlog/security/advisories/GHSA-939m-47f7-m559 - Exploit, Vendor Advisory |
19 May 2025, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| CWE |
15 May 2025, 20:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-05-15 20:16
Updated : 2025-06-12 16:39
NVD link : CVE-2025-47785
Mitre link : CVE-2025-47785
JSON object : View
Products Affected
emlog
- emlog
CWE
No CWE.