CyberRota Analysis
AI-GeneratedEmlog versions 2.6.26 and earlier are vulnerable due to the install.php script allowing unauthenticated reinstallation, enabling remote attackers to overwrite the configuration file with malicious database settings and create unauthorized administrator accounts. This critical vulnerability poses a significant risk to any installations of Emlog, particularly those exposed to the internet. Organizations using Emlog should prioritize immediate remediation efforts, as no patch is currently available.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Emlog is an open source website building system. In 2.6.26 and earlier, install.php accepts action=reinstall without authentication and deliberately skips the already-installed check because the guard runs only when $act != 'reinstall'. A remote attacker can submit hostname, dbuser, dbpasswd, dbname, dbprefix, username, password, and email values to cause file_put_contents('config.php', $config) to overwrite the configuration with attacker-controlled database settings and create a new administrator account. No fixed version is available as of this review.