CVE-2025-25823
Published: 26 February 2025
Summary
CVE-2025-25823 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Emlog Emlog. Its CVSS base score is 7.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Browser Session Hijacking (T1185); ranked at the 32.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the XSS vulnerability by validating and sanitizing crafted payloads injected into the article header at /admin/article.php to prevent arbitrary script execution.
Prevents execution of injected malicious scripts by filtering and encoding article header outputs before rendering in victims' browsers.
Addresses the specific flaw in Emlog Pro v2.5.4 through timely identification, reporting, and patching to remediate the XSS vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stored/reflected XSS directly enables arbitrary script execution in victim browser, facilitating session hijacking as described.
NVD Description
A cross-site scripting (XSS) vulnerability in Emlog Pro v2.5.4 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the article header at /admin/article.php.
Deeper analysisAI
CVE-2025-25823, published on 2025-02-26, is a cross-site scripting (XSS) vulnerability classified under CWE-79 that affects Emlog Pro version 2.5.4. The issue occurs in the article header functionality at the /admin/article.php endpoint, where attackers can inject a crafted payload to execute arbitrary web scripts or HTML. It carries a CVSS v3.1 base score of 7.3 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L), reflecting high impacts on confidentiality and integrity with low availability impact.
Attackers can exploit this vulnerability by injecting malicious payloads into the article header through the affected admin interface. Exploitation requires local access vector with low attack complexity, no privileges, and user interaction, enabling execution of arbitrary scripts in the context of the victim's browser. This can lead to outcomes such as session hijacking, data theft, or unauthorized actions on the site.
Advisories and further details on mitigation are available in the provided references: http://emlogpro.com, https://github.com/Ka7arotto/emlog/blob/main/xss-3.md, and https://www.emlog.net/. Security practitioners should review these sources for recommended patches or workarounds.
Details
- CWE(s)