Stored XSS in Emlog Admin Backend User Search

Executive Summary

This is a Reflected Cross-Site Scripting (XSS) vulnerability in Emlog versions 2.6.13 and earlier. The admin backend user search module's keyword parameter is processed with addslashes but not HTML-escaped before being rendered in the HTML input field. This allows an attacker to inject malicious JavaScript code via a crafted link, which executes in the administrator's browser session.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your Emlog installation is version 2.6.13 or earlier. Inspect the admin/user.php file for the keyword parameter handling and verify if the admin/views/user.php template renders the keyword without HTML escaping. Look for reflected XSS patterns in user search inputs.

Useful 0 Not Useful 0

Impact Analysis

An attacker could steal the administrator's session cookie (EM_AUTHCOOKIE) to gain full control over the account. They could also leak sensitive information like backend page content, database configurations, and user lists. The attack requires tricking an administrator into clicking a malicious link, often through phishing.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Emlog to the latest version if available. If no update exists, modify the admin/views/user.php template to apply htmlspecialchars() to the keyword variable before rendering it in the HTML input field. Remove any unnecessary admin access and monitor for suspicious activity.

Useful 0 Not Useful 0