A critical authentication bypass vulnerability in emlog allows unauthenticated remote attackers to take full control of the website.

The install.php script fails to perform authentication checks when the action parameter is set to reinstall, effectively allowing an attacker to reconfigure the application. This permits the attacker to overwrite the site configuration and gain administrative privileges.

This vulnerability allows for complete site takeover, granting an attacker administrative access to the platform. With a CVSS score of 9.8, the potential for unauthorized data access, content manipulation, and further exploitation of the host server is extreme.

Immediate Action: As no official patch is currently available, restrict access to the install.php file at the web server level to prevent unauthorized execution.

Proactive Monitoring: Monitor site configuration files for unexpected changes and audit administrative user lists for unauthorized accounts.

Compensating Controls: Implement file system permissions that prevent the web server user from modifying config.php after the initial installation is complete.

Public Exploit Available: Unknown

Due to the severity of this vulnerability and the current absence of a patch, users must take manual steps to secure their installations. We strongly recommend restricting access to installation scripts and monitoring the integrity of core configuration files until the vendor releases a secure update.