Emlog Pro Cross-Site Scripting Vulnerability

A cross-site scripting (XSS) vulnerability exists in Emlog Pro version 2.5.4. This vulnerability allows attackers to execute arbitrary web scripts or HTML by injecting a crafted payload into the postStrVar function within the article_save.php file.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, save an article in Emlog Pro version 2.5.4. Inject a script or HTML payload into the postStrVar function, which is processed by the article_save.php file. Once the article is saved, the injected script will be executed, demonstrating the cross-site scripting vulnerability.