Emlog Cross-Site Scripting Vulnerability

A cross-site scripting (XSS) vulnerability has been identified in Emlog versions prior to and including pro-2.5.17. This vulnerability allows remote attackers to inject arbitrary web scripts or HTML through the comment and comname parameters. The XSS is reflected, requiring the victim to be persuaded to click a link that sends a POST request, which then executes the injected script.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where injected scripts are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, send a POST request to the Emlog comment submission endpoint ('index.php?action=addcom') with a crafted comment that includes HTML tags and JavaScript, such as an image tag with an 'onerror' event. The 'comname' parameter can be used similarly to inject scripts. Once the request is submitted, the injected script will execute in the user's browser.