| 제목 | Emlog Emlog Pro 2.5.19 Cross Site Scripting |
|---|
| 설명 | article_save.php contains a critical stored cross-site scripting (XSS) vulnerability fundamentally caused by the absence of effective input sanitization and output encoding mechanisms for user-submitted article data (including titles, body content, and excerpts). This allows malicious scripts to be persistently stored in the database unchanged. When this contaminated data is subsequently rendered in article.php's administrative interfaces (such as article listings or edit pages) or public-facing article displays, browsers directly parse and execute embedded JavaScript payloads. Attackers can exploit this to craft malicious scripts enabling cookie theft, session hijacking, or back-end system takeover, triggered when administrators or regular users view compromised articles. This creates a complete attack chain from data storage to display. Crucially, the lack of HTML whitelist filtering for rich text content ($logcontent) enables injection of arbitrary complex HTML/JavaScript code, significantly expanding the vulnerability's threat surface and potential impact. |
|---|
| 원천 | ⚠️ https://github.com/chen2496088236/CVE/issues/6 |
|---|
| 사용자 | 111ctx (UID 89466) |
|---|
| 제출 | 2025. 08. 28. PM 12:26 (1 년도 ago) |
|---|
| 모더레이션 | 2025. 09. 11. PM 05:13 (14 days later) |
|---|
| 상태 | 중복 |
|---|
| VulDB 항목 | 297627 [Emlog Pro 2.5.4 article_save.php postStrVar 크로스 사이트 스크립팅] |
|---|
| 포인트들 | 0 |
|---|