CVE-2025-30372

CRITICAL

Emlog Pro 2.5.7-2.5.8 - SQL Injection via URL Double Encoding Bypass in search_controller.php

Title source: llm
STIX 2.1

Description

Emlog is an open source website building system. Emlog Pro versions pro-2.5.7 and pro-2.5.8 contain an SQL injection vulnerability. `search_controller.php` does not use addslashes after urldecode, allowing the preceeding addslashes to be bypassed by URL double encoding. This could result in potential leakage of sensitive information from the user database. Version pro-2.5.9 fixes the issue.

References (1)

Core 1

Scores

CVSS v3 9.8
EPSS 0.0048
EPSS Percentile 37.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact partial

Details

CWE
CWE-89
Status published
Products (1)
emlog/emlog < 2.5.9
Published Mar 28, 2025
Tracked Since Feb 18, 2026