| 제목 | Emlog Emlog Pro 2.5.19 Cross Site Scripting |
|---|
| 설명 | A separate stored cross-site scripting (XSS) vulnerability exists in the article/comment audit functionality of Emlog, specifically within the comments.php file. The feedback parameter, which is intended for administrators to provide a rejection reason when "rejecting" a submission, is not properly sanitized before storage.
An authenticated administrator, potentially under the guise of a compromised account or a malicious insider, can inject malicious JavaScript code into this feedback field. When the author of the rejected content (a standard user) later logs into their account and views the rejection notice within the administrative panel, the stored script is executed within their browser session.
This vulnerability enables a privileged attacker to target specific, lower-privileged users, potentially escalating privileges by stealing their session cookies or performing actions on their behalf. |
|---|
| 원천 | ⚠️ https://github.com/chen2496088236/CVE/issues/7 |
|---|
| 사용자 | 111ctx (UID 89466) |
|---|
| 제출 | 2025. 08. 29. PM 01:55 (1 년도 ago) |
|---|
| 모더레이션 | 2025. 09. 11. PM 05:17 (13 days later) |
|---|
| 상태 | 중복 |
|---|
| VulDB 항목 | 174322 [emlog 6.0 Article Comment 크로스 사이트 스크립팅] |
|---|
| 포인트들 | 0 |
|---|