Emlog Pro File Upload Vulnerability Allowing Arbitrary Code Execution

A file upload vulnerability has been identified in Emlog Pro versions prior to 2.5.10. The issue resides in the store.php component, which improperly validates the contents of remotely downloaded ZIP plugin files. This lack of adequate validation enables attackers to execute arbitrary code on the affected system.

Impact

Exploitation of this vulnerability could lead to a full server takeover.

Reproduction

To reproduce this vulnerability, first deploy a malicious script on a remote server, creating a folder with the same name, and compress it into a ZIP file. After enabling the HTTP service, initiate a remote download request through the vulnerable Emlog Pro installation, using the admin/store.php endpoint. Once the ZIP file is downloaded and extracted, the malicious script will be executed on the server.

Remediation

Users can upgrade to Emlog Pro version 2.5.10 or later, where this vulnerability has been patched.