| tiêu đề | Emlog Emlog Pro 2.5.19 Cross Site Scripting |
|---|
| Mô tả | article_save.php contains a critical stored cross-site scripting (XSS) vulnerability fundamentally caused by the absence of effective input sanitization and output encoding mechanisms for user-submitted article data (including titles, body content, and excerpts). This allows malicious scripts to be persistently stored in the database unchanged. When this contaminated data is subsequently rendered in article.php's administrative interfaces (such as article listings or edit pages) or public-facing article displays, browsers directly parse and execute embedded JavaScript payloads. Attackers can exploit this to craft malicious scripts enabling cookie theft, session hijacking, or back-end system takeover, triggered when administrators or regular users view compromised articles. This creates a complete attack chain from data storage to display. Crucially, the lack of HTML whitelist filtering for rich text content ($logcontent) enables injection of arbitrary complex HTML/JavaScript code, significantly expanding the vulnerability's threat surface and potential impact. |
|---|
| Nguồn | ⚠️ https://github.com/chen2496088236/CVE/issues/6 |
|---|
| Người dùng | 111ctx (UID 89466) |
|---|
| Đệ trình | 28/08/2025 12:26 (cách đây 1 Năm) |
|---|
| Kiểm duyệt | 11/09/2025 17:13 (14 days later) |
|---|
| Trạng thái | Bản sao |
|---|
| Mục VulDB | 297627 [Emlog Pro 2.5.4 article_save.php postStrVar Tập lệnh chéo trang] |
|---|
| điểm | 0 |
|---|