Emlog Cross-Site Scripting Vulnerability in Article Management

A cross-site scripting (XSS) vulnerability has been identified in Emlog versions through 2.5.7. The issue arises in the file '/admin/article.php', where the 'active_post' parameter is not properly sanitized before being output, allowing for the injection of malicious scripts. This vulnerability can be exploited remotely, but requires user interaction.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, access the '/admin/article.php' page while logged into an account with permission to manage articles. Once on the page, manipulate the 'active_post' parameter by injecting a script or other malicious content. The lack of proper input validation will result in the injected content being executed as a script, demonstrating the cross-site scripting vulnerability.