CVE-2025-30372: Emlog Pro SQL Injection Vulnerability

CVE-2025-30372 Overview

CVE-2025-30372 is a SQL Injection vulnerability affecting Emlog, an open source website building system. The vulnerability exists in versions pro-2.5.7 and pro-2.5.8 of Emlog Pro, where the search_controller.php component fails to properly sanitize user input after URL decoding. By using URL double encoding techniques, attackers can bypass the addslashes protection and inject malicious SQL queries, potentially leading to unauthorized access to sensitive information stored in the user database.

Critical Impact

This SQL injection vulnerability allows unauthenticated attackers to bypass input sanitization via URL double encoding, enabling extraction of sensitive user data from the database without requiring any user interaction or authentication.

Affected Products

• Emlog Pro version pro-2.5.7
• Emlog Pro version pro-2.5.8

Discovery Timeline

• 2025-03-28 - CVE-2025-30372 published to NVD
• 2025-04-14 - Last updated in NVD database

Technical Details for CVE-2025-30372

Vulnerability Analysis

This SQL injection vulnerability stems from improper input validation in Emlog Pro's search functionality. The search_controller.php file processes user-supplied search parameters that undergo URL decoding via urldecode() after the initial sanitization with addslashes() has been applied. This ordering flaw creates a security gap where encoded malicious characters pass through the sanitization layer in their encoded form, only to be decoded into dangerous SQL metacharacters afterward.

The attack can be performed remotely over the network without requiring any authentication or user interaction. Successful exploitation allows attackers to read sensitive data from the database, including user credentials, email addresses, and other stored information. The vulnerability poses a significant risk of confidentiality breach but does not directly enable data modification or system availability impacts.

Root Cause

The root cause of CVE-2025-30372 is the incorrect order of operations in the input processing pipeline. The addslashes() function is applied to the raw input first, escaping special characters like single quotes. However, when urldecode() is subsequently called on the same input, any URL-encoded characters (such as %27 for a single quote) are decoded into their literal equivalents after the sanitization has already occurred. This allows attackers to craft double-encoded payloads that bypass the initial protection entirely.

Attack Vector

The attack vector for CVE-2025-30372 is network-based, targeting the search functionality of Emlog Pro installations. An attacker can exploit this vulnerability by sending specially crafted HTTP requests to the search endpoint with double URL-encoded SQL injection payloads.

For example, a single quote character (') would normally be escaped by addslashes(). However, by encoding it as %2527 (where %25 decodes to % and 27 represents the quote), the first decoding produces %27, which passes through addslashes() unchanged, and the second decoding (via explicit urldecode() call in the code) converts it to a literal single quote, enabling SQL injection.

The vulnerability allows attackers to extract sensitive information from the database through error-based or blind SQL injection techniques. For detailed technical information, see the GitHub Security Advisory.

Detection Methods for CVE-2025-30372

Indicators of Compromise

• Unusual HTTP requests to search endpoints containing double-encoded characters (e.g., %25, %2527, %252f)
• Database logs showing anomalous queries originating from the search functionality
• Web application firewall logs detecting SQL injection patterns in search parameters
• Unexpected database errors or information disclosure in application responses

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block double URL-encoded payloads
• Monitor HTTP access logs for requests containing %25 sequences followed by hex digits
• Enable database query logging and alert on queries containing UNION, SELECT, or other SQL keywords from the search module
• Deploy intrusion detection signatures for SQL injection attempts targeting Emlog installations

Monitoring Recommendations

• Configure real-time alerting for any SQL syntax errors generated by the search controller
• Monitor for unusual data exfiltration patterns such as large response sizes from search queries
• Track failed authentication attempts that may indicate attackers using extracted credentials
• Implement egress monitoring for potential data theft following successful exploitation

How to Mitigate CVE-2025-30372

Immediate Actions Required

• Upgrade Emlog Pro to version pro-2.5.9 or later immediately
• Review database access logs for signs of prior exploitation
• Consider temporarily disabling the search functionality if immediate patching is not possible
• Reset user passwords if database compromise is suspected

Patch Information

Emlog has addressed this vulnerability in version pro-2.5.9. The fix corrects the order of input sanitization operations, ensuring that URL decoding occurs before addslashes() is applied, or by implementing proper parameterized queries. Administrators should update their Emlog Pro installations immediately by downloading the latest version from the official Emlog repository.

For additional details about the vulnerability and patch, refer to the GitHub Security Advisory GHSA-w6xc-r6x5-m77c.

Workarounds

• Implement a web application firewall (WAF) rule to block requests containing double URL-encoded characters
• Apply input validation at the web server level to reject requests with %25 sequences in search parameters
• Restrict access to the search functionality to authenticated users only as a temporary measure
• Consider placing vulnerable Emlog installations behind a reverse proxy with SQL injection filtering capabilities

# Example nginx configuration to block double-encoded requests
location /search {
    if ($request_uri ~* "%25") {
        return 403;
    }
    # existing configuration
}