Description

Emlog is an open source website building system. In 2.6.26 and earlier, missing CSRF protection on the AI Assistant execute_tool action in admin/ai.php lets a remote unauthenticated attacker submit a forged cross-site request from an attacker-controlled page to a recently logged-in administrator. The authentication cookie set in include/lib/loginauth.php has no explicit SameSite attribute, enabling Chrome's temporary Lax+POST grace window. The query_database case passes attacker-controlled sql and confirm_code values to Ai::queryDatabase in include/service/ai.php; read queries need no confirmation, write queries accept the public confirm string, only the blog table is write-protected, and aliasing password as pwd_hash bypasses output redaction. A successful request can read every database table and write every table except blog, including changing the user table to take over an administrator account. No fixed version is available as of this review.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-08-14T18:19:09.843Z",
  "pubdate": "2026-08-14T18:19:09.843Z",
  "executiveSummary": "Emlog versions 2.6.26 and earlier suffer from a critical Cross-Site Request Forgery (CSRF) vulnerability coupled with insufficient access controls and SQL injection vulnerabilities within the AI Assistant administrative component. The root cause stems from missing anti-CSRF token validation on the execute_tool action located in admin/ai.php, combined with an unconfigured SameSite attribute on authentication cookies set by include/lib/loginauth.php. This exposes browsers, specifically Chrome during its Lax+POST grace window, to forged cross-site requests originating from attacker-controlled web pages targeting an authenticated administrator.\nA remote unauthenticated attacker can exploit this combination by tricking a recently logged-in administrator into visiting a malicious site, which silently submits arbitrary database queries and execution commands to the underlying AI service handler in include/service/ai.php. The resulting impact is severe, allowing an attacker to read arbitrary database tables, execute write queries against all tables except the blog table, and execute administrative account takeovers by directly modifying user records. Since no official fixed version is currently available, the risk implications remain critical for all deployments running the affected versions.",
  "technicalDetails": "The vulnerability manifests within the administrative AI Assistant module of Emlog, specifically inside admin/ai.php, where the execute_tool action lacks proper Cross-Site Request Forgery (CSRF) protection. Furthermore, session management in include/lib/loginauth.php fails to explicitly define a SameSite attribute on the authentication cookie. This oversight allows Chrome's temporary Lax+POST grace window to permit cross-site POST requests with accompanying credentials, enabling seamless session hijacking via third-party contexts.\nThe attack flow proceeds when an attacker entices a recently authenticated administrator to load a malicious web page configured to dispatch a forged POST request to the target Emlog installation. This request invokes the query_database case handling block within the vulnerable endpoint. The input parameters, including attacker-controlled sql and confirm_code values, are passed directly to the Ai::queryDatabase method located in include/service/ai.php without adequate sanitization or structural validation.\nWithin the database querying logic, read operations require no confirmation, while write operations rely on a publicly known confirmation string. The authorization check exhibits a critical flaw by only write-protecting the blog table, leaving all other database tables exposed to arbitrary data manipulation. Additionally, attackers can bypass output redaction mechanisms designed to protect sensitive information by aliasing the password column as pwd_hash in their injected queries.\nThe post-exploitation capabilities granted by this vector are extensive. An attacker can successfully read contents from every database table and write to every table with the sole exception of the blog table. This includes modifying records within the user table to execute an administrative account takeover, thereby granting full administrative control over the underlying website building system."
}