CVE-2025-47785: EMLOG SQL Injection Vulnerability
Emlog is an open source website building system. In versions up to and including 2.5.9, SQL injection occurs because the $origContent parameter in admin/articlesave.php is not strictly filtered. Since admin/articlesave.php can be accessed by ordinary registered users, this will cause SQL injection to occur when the registered site is enabled, resulting in the injection of the admin account and password, which is then exploited by the backend remote code execution. As of time of publication, it is unknown whether a fix exists.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-47785?
CVE-2025-47785 has been classified as a critical SQL injection vulnerability due to its potential impact on system security.
How do I fix CVE-2025-47785?
To fix CVE-2025-47785, upgrade Emlog to version 2.6 or later, which includes necessary patches for the SQL injection vulnerability.
What versions are affected by CVE-2025-47785?
CVE-2025-47785 affects Emlog versions up to and including 2.5.9.
Can registered users exploit CVE-2025-47785?
Yes, registered users may exploit CVE-2025-47785 because the vulnerable script admin/article_save.php is accessible to them.
What are the risks associated with CVE-2025-47785?
The risks associated with CVE-2025-47785 include unauthorized access to the database and potential data leakage or manipulation.