CyberRota Analysis
AI-GeneratedEmlog CMS Pro versions prior to 2.6.16 are vulnerable to a blind SQL injection in the User_Model::getUserDataByLogin() function, where the $account parameter is directly used in SQL queries without proper sanitization. This vulnerability can be exploited through the authentication cookie validation process, potentially allowing attackers to manipulate database queries and access sensitive information. Organizations using affected versions should prioritize upgrading to version 2.6.16 or later to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Emlog is an open source website building system. Prior to version 2.6.16, Emlog CMS Pro contains a blind SQL injection in User_Model::getUserDataByLogin(). The $account parameter is directly interpolated into SQL queries without any filtering. The vulnerability is reachable through the auth cookie validation path, where $username is extracted from the cookie and passed unfiltered into SQL — guarded only by an HMAC signature that requires AUTH_KEY to forge. This issue has been patched in version 2.6.16.