Emlog Stored Cross-Site Scripting(XSS)

Description

The client lacks proper validation when storing user input, resulting in a stored xss vulnerability.

Vendor Homepage

https://www.emlog.net/
https://github.com/emlog/emlog

Proof of Concept

1. Install emlog and log in as administrator.

2. In the left navigation bar, enter the “微语” function and enter the payload:

<script>alert(document.cookie)</script>

Then click “发布” botton.

3. Add “微语” at “外观”-“边栏”.

4. All users now will trigger the attack code and a pop-up window when they enter the homepage of the website.