Emlog Cross-Site Scripting Vulnerability

A cross-site scripting (XSS) vulnerability has been identified in Emlog versions prior to pro-2.5.17. This vulnerability allows remote attackers to inject arbitrary web scripts or HTML into the keyword parameter, due to insufficient input sanitization. Exploitation of this issue could enable the execution of injected JavaScript in the browser of an admin user.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where injected scripts are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, first create a malicious URL that includes injected JavaScript or HTML in the keyword parameter. This can be done by crafting a link that, when clicked, will execute the injected script, such as an image tag with an 'onerror' event. Once the URL is prepared, persuade an admin user to click on the link. The injected JavaScript will then execute in the user's browser.