SQL Injection Vulnerability in Emlog Pro Website Builder
CVE-2025-30372

7.7HIGH

Key Information:

Vendor

Emlog

Status
Emlog
Vendor
CVE Published:
28 March 2025

What is CVE-2025-30372?

Emlog Pro versions 2.5.7 and 2.5.8 are vulnerable to an SQL injection attack due to improper handling of user input in search_controller.php. The failure to apply the addslashes function after urldecode allows attackers to bypass security measures, potentially leading to unauthorized access to sensitive user data. Users are advised to upgrade to version 2.5.9, which addresses this issue effectively.

Affected Version(s)

emlog >= pro-2.5.7, < pro-2.5.9

References

https://github.com/emlog/emlog/security/advisories/GHSA-w...
x_refsource_CONFIRM

CVSS V4

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-30372 : SQL Injection Vulnerability in Emlog Pro Website Builder