CVE-2025-30372

CRITICAL

9.8

Description

Emlog is an open source website building system. Emlog Pro versions pro-2.5.7 and pro-2.5.8 contain an SQL injection vulnerability. `search_controller.php` does not use addslashes after urldecode, allowing the preceeding addslashes to be bypassed by URL double encoding. This could result in potential leakage of sensitive information from the user database. Version pro-2.5.9 fixes the issue.

CVE Details

CVSS v3.1 Score9.8

SeverityCRITICAL

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

Published3/28/2025

Last Modified4/14/2025

Sourcenvd

Honeypot Sightings0

Affected Products

emlog:emlog

Weaknesses (CWE)

CWE-89

References

https://github.com/emlog/emlog/security/advisories/GHSA-w6xc-r6x5-m77c(security-advisories@github.com)

https://github.com/emlog/emlog/security/advisories/GHSA-w6xc-r6x5-m77c(134c704f-9b21-4f2e-91b3-4a467353bcc0)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.