Emlog Pro Cross-Site Scripting Vulnerability

A cross-site scripting (XSS) vulnerability exists in Emlog Pro version 2.5.4. This vulnerability allows attackers to execute arbitrary web scripts or HTML by injecting a crafted payload into the article header via the admin article management page.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, log into the Emlog Pro admin panel and navigate to the article management page. While creating or editing an article, inject a script or HTML payload into the article header. Once the article is saved and viewed, the injected script will execute, demonstrating the cross-site scripting vulnerability.