Executive Summary

This vulnerability exists in Emlog, an open source website building system, prior to version 2.6.8. The backend upgrade interface accepts remote SQL and ZIP file URLs via GET parameters without validating a CSRF token. As a result, an attacker can trick an authenticated administrator into visiting a malicious link, which causes the server to download and execute an arbitrary SQL file and then download and extract a ZIP file directly into the web root directory. This leads to arbitrary SQL execution and arbitrary file write on the server.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows an attacker to execute arbitrary SQL commands and write arbitrary files on the server by tricking an authenticated administrator into visiting a malicious link. This can lead to unauthorized data manipulation, data loss, or corruption, as well as the potential for remote code execution or website defacement by placing malicious files in the web root directory.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Emlog to version 2.6.8 or later, where the issue has been patched.

Additionally, avoid allowing authenticated administrators to visit untrusted or suspicious links that could exploit the lack of CSRF token validation in the backend upgrade interface.

Useful 0 Not Useful 0