cnvd - cnvd-2025-01706

cnvd-2025-01706

Vulnerability from cnvd

Title: Emlog Pro跨站脚本漏洞（CNVD-2025-01706）

Description:

Emlog Pro是一款轻量级的博客系统，提供简单易用的博客管理功能。

Emlog Pro 2.4.3中存在跨站脚本漏洞。该漏洞源于Subpage Handler组件的文件/admin/twitter.php中的未知功能。攻击者可利用该漏洞进行跨站脚本攻击。

Severity: 中

Formal description:

厂商尚未提供漏洞修复方案，请关注厂商主页更新： https://github.com/emlog/emlog

Reference: https://vuldb.com/?id.290209 https://vuldb.com/?ctiid.290209 https://vuldb.com/?submit.467929 https://github.com/emlog/emlog/issues/311 https://github.com/emlog/emlog/issues/311#issue-2755404584

Impacted products

Name
emlog emlog pro 2.4.3

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2024-13135",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-13135"
    }
  },
  "description": "Emlog Pro\u662f\u4e00\u6b3e\u8f7b\u91cf\u7ea7\u7684\u535a\u5ba2\u7cfb\u7edf\uff0c\u63d0\u4f9b\u7b80\u5355\u6613\u7528\u7684\u535a\u5ba2\u7ba1\u7406\u529f\u80fd\u3002\n\nEmlog Pro 2.4.3\u4e2d\u5b58\u5728\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\u3002\u8be5\u6f0f\u6d1e\u6e90\u4e8eSubpage Handler\u7ec4\u4ef6\u7684\u6587\u4ef6/admin/twitter.php\u4e2d\u7684\u672a\u77e5\u529f\u80fd\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u8fdb\u884c\u8de8\u7ad9\u811a\u672c\u653b\u51fb\u3002",
  "formalWay": "\u5382\u5546\u5c1a\u672a\u63d0\u4f9b\u6f0f\u6d1e\u4fee\u590d\u65b9\u6848\uff0c\u8bf7\u5173\u6ce8\u5382\u5546\u4e3b\u9875\u66f4\u65b0\uff1a\r\nhttps://github.com/emlog/emlog",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2025-01706",
  "openTime": "2025-01-15",
  "products": {
    "product": "emlog emlog pro 2.4.3"
  },
  "referenceLink": "https://vuldb.com/?id.290209\r\nhttps://vuldb.com/?ctiid.290209\r\nhttps://vuldb.com/?submit.467929\r\nhttps://github.com/emlog/emlog/issues/311\r\nhttps://github.com/emlog/emlog/issues/311#issue-2755404584",
  "serverity": "\u4e2d",
  "submitTime": "2025-01-10",
  "title": "Emlog Pro\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\uff08CNVD-2025-01706\uff09"
}

CVE-2024-13135 (GCVE-0-2024-13135)

Vulnerability from cvelistv5

Published

2025-01-05 08:31

Modified

2025-01-06 15:58

Severity ?

5.3 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
3.5 (Low) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
3.5 (Low) - CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

CWE

CWE-79 - Cross Site Scripting
CWE-94 - Code Injection

Summary

A vulnerability has been found in Emlog Pro 2.4.3 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/twitter.php of the component Subpage Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

References

▼	URL	Tags
	https://vuldb.com/?id.290209	vdb-entry
	https://vuldb.com/?ctiid.290209	signature, permissions-required
	https://vuldb.com/?submit.467929	third-party-advisory
	https://github.com/emlog/emlog/issues/311	issue-tracking
	https://github.com/emlog/emlog/issues/311#issue-2755404584	exploit, issue-tracking

Impacted products

	Vendor	Product	Version
	n/a	Emlog Pro	Version: 2.4.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-13135",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-06T15:57:45.761759Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-01-06T15:58:24.165Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "Subpage Handler"
          ],
          "product": "Emlog Pro",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "2.4.3"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "zonesec (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability has been found in Emlog Pro 2.4.3 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/twitter.php of the component Subpage Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used."
        },
        {
          "lang": "de",
          "value": "In Emlog Pro 2.4.3 wurde eine Schwachstelle gefunden. Sie wurde als problematisch eingestuft. Hierbei betrifft es unbekannten Programmcode der Datei /admin/twitter.php der Komponente Subpage Handler. Durch das Manipulieren mit unbekannten Daten kann eine cross site scripting-Schwachstelle ausgenutzt werden. Umgesetzt werden kann der Angriff \u00fcber das Netzwerk. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 3.5,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 3.5,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 4,
            "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Cross Site Scripting",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "Code Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-01-05T08:31:04.864Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-290209 | Emlog Pro Subpage twitter.php cross site scripting",
          "tags": [
            "vdb-entry"
          ],
          "url": "https://vuldb.com/?id.290209"
        },
        {
          "name": "VDB-290209 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/?ctiid.290209"
        },
        {
          "name": "Submit #467929 | github emlog pro 2.4.3 Cross Site Scripting",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/?submit.467929"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/emlog/emlog/issues/311"
        },
        {
          "tags": [
            "exploit",
            "issue-tracking"
          ],
          "url": "https://github.com/emlog/emlog/issues/311#issue-2755404584"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-01-04T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2025-01-04T01:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2025-01-04T10:42:05.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "Emlog Pro Subpage twitter.php cross site scripting"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2024-13135",
    "datePublished": "2025-01-05T08:31:04.864Z",
    "dateReserved": "2025-01-04T09:33:42.550Z",
    "dateUpdated": "2025-01-06T15:58:24.165Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted