Description

Emlog is an open source website building system. In 2.6.26 and earlier, install.php accepts action=reinstall without authentication and deliberately skips the already-installed check because the guard runs only when $act != 'reinstall'. A remote attacker can submit hostname, dbuser, dbpasswd, dbname, dbprefix, username, password, and email values to cause file_put_contents('config.php', $config) to overwrite the configuration with attacker-controlled database settings and create a new administrator account. No fixed version is available as of this review.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-14T18:19:09.987Z",
  "pubdate": "2026-08-14T18:19:09.987Z",
  "executiveSummary": "Emlog versions 2.6.26 and earlier suffer from an unauthenticated configuration overwrite vulnerability within the installation and setup mechanism. The flaw resides in install.php, which inadequately validates the installation state when processing specific request parameters.\nA remote unauthenticated attacker can exploit this vulnerability by submitting a crafted HTTP request with the action parameter set to reinstall. This bypasses the pre-installation check intended to prevent unauthorized re-initialization of the application because the guard condition executes exclusively when the action parameter is not set to reinstall.\nUpon successful exploitation, the application processes attacker-supplied configuration parameters including hostname, dbuser, dbpasswd, dbname, dbprefix, username, password, and email. The vulnerable script then invokes the file_put_contents function to overwrite the existing config.php file with attacker-controlled database settings and concurrently provisions a brand-new administrator account.\nThis introduces severe risk implications, including complete application takeover, loss of data integrity, and potential remote code execution via database manipulation or administrative capabilities. No fixed version is available as of this review, and remediation requires manual hardening or source code modifications.",
  "technicalDetails": "The vulnerability is rooted in the insecure design and state-validation logic of install.php within Emlog versions 2.6.26 and earlier. Specifically, the application relies on an installation guard mechanism designed to prevent the re-initialization of an already installed instance. However, this guard condition is programmatically bypassed when the input parameter action is explicitly set to reinstall ($act != 'reinstall').\nExploitation does not require authentication, prior privileges, or interaction with an administrative interface. A remote attacker interacting over the network can directly invoke install.php with the action=reinstall parameter, successfully evading the already-installed check.\nThe attack flow proceeds as follows: First, the attacker sends an HTTP request to install.php containing action=reinstall along with malicious payload parameters. Second, the script processes the input parameters, which include database configuration variables such as hostname, dbuser, dbpasswd, dbname, and dbprefix, alongside administrative credentials comprising username, password, and email.\nThird, the vulnerable component executes file_put_contents('config.php', $config), overwriting the critical configuration file with the attacker-controlled database settings. Finally, the script provisions a new administrative account within the newly designated database context, granting the attacker persistent administrative access to the platform.\nPost-exploitation impact includes full administrative compromise of the web application, unauthorized database redirection, and potential subsequent system compromise due to administrative control over the Emlog instance."
}