CVE-2026-73847

Executive Summary

CVE-2026-73847 is a cross-site request forgery (CSRF) vulnerability in Emlog, an open source website building system, affecting version 2.6.26 and earlier. The flaw resides in the AI Assistant execute_tool action in admin/ai.php, where missing CSRF protection allows a remote, unauthenticated attacker to abuse a recently logged-in administrator's session to perform arbitrary SQL read/write operations through the query_database case. A successful attack can read all database tables and modify all tables except the blog table, including changing credentials in the user table to achieve administrator account takeover. No patched version is currently available.

Technical Analysis

The vulnerability is a CSRF flaw combined with dangerous database functionality exposed through the administrative AI Assistant. The NVD description identifies the vulnerable request path as the execute_tool action in admin/ai.php. Because no CSRF token or origin validation is performed, an attacker-controlled page can forge a cross-origin request to this administrative endpoint. The session cookie is set in include/lib/loginauth.php without an explicit SameSite attribute. In Chrome, the temporary Lax+POST grace window permits a cross-site POST request shortly after the cookie is set, making a recently logged-in administrator especially vulnerable.

The query_database case inside admin/ai.php forwards attacker-controlled sql and confirm_code parameters to Ai::queryDatabase in include/service/ai.php. The database wrapper has weak protections:

• Read queries require no confirmation value.
• Write queries accept a public confirmation string.
• The blog table is explicitly write-protected.
• Output redaction can be bypassed by aliasing the password column as pwd_hash.

This allows the attacker to execute arbitrary SQL statements through the admin session. The lack of a valid CSRF token means the browser automatically attaches the administrator's session cookie to the forged request, and the server cannot distinguish the forged request from a legitimate one.

The attack surface is the Emlog administration interface, specifically the AI Assistant feature exposed under admin/ai.php. Any Emlog installation with the AI Assistant enabled and an administrator who recently authenticated is potentially affected. Because the vulnerability is present in the control panel, exploitation does not require direct access to the database or server, only a browser-based forged request.

Exploitation Scenarios

No public exploit code or PoC is available, so the attack chain is inferred from the NVD description and vulnerability class.

1. Reconnaissance / target identification
   An attacker locates publicly accessible Emlog installations using search engines or Shodan queries for the Emlog administrative interface. The attacker identifies an environment where an administrator may have recently logged in. The AI Assistant must be reachable at the admin/ai.php endpoint.

2. Triggering the CSRF flaw
   The attacker hosts a malicious page or injects content into a site the victim browses. The page contains a hidden form or JavaScript that automatically submits a forged request to the victim's Emlog admin URL. Because the administrator's session cookie lacks an explicit SameSite attribute, the browser includes it in the cross-site request during Chrome's temporary Lax+POST grace window. Since admin/ai.php has no CSRF protection, the request is accepted as legitimate.

3. Payload / execution method
   The forged request targets the execute_tool action with the query_database case. The attacker supplies arbitrary values for the sql and confirm_code parameters. Example actions include:

   • Issuing read queries against any database table without confirmation.
   • Issuing write queries using the public confirmation string.
   • Updating rows in any table except blog.
   • Using SQL such as SELECT ... AS pwd_hash to bypass output redaction and recover password hashes.

4. Post-exploitation impact
   The attacker can enumerate the full database, extract password hashes or other sensitive data, and modify the user table. By changing an existing administrator password hash, the attacker gains direct administrative access to the Emlog control panel. From there, the attacker can install themes or plugins, upload files, or otherwise achieve full application compromise. Because availability impact is rated none in the CVSS vector, the attacker is more likely to focus on data theft and privilege escalation than on disruption.

Impact Assessment

The CVSS v3.1 score is 6.8 with vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N. The vulnerability is network-accessible but requires high attack complexity due to the specific Chrome Lax+POST grace window and the need for a recently logged-in administrator to visit an attacker-controlled page.

• Confidentiality impact: High — Every database table can be read, including user credentials, membership data, and application content.
• Integrity impact: High — Every database table except blog can be modified, including the user table, enabling administrator account takeover.
• Availability impact: None — The described attack does not directly destroy data or deny service.

The business impact is severe for Emlog-based sites because the attacker can fully take over the administrative account through a single forged request. This can lead to website defacement, malicious content injection, credential theft, and downstream attacks against site visitors. The attack is especially dangerous in shared hosting or environments where the database contains customer or internal data. The low EPSS score (0.00167, 6.4th percentile) suggests that in-the-wild exploitation is currently uncommon, but the lack of a patch increases the risk window.

Detection Guidance

Sigma Rule

title: Emlog AI Assistant CSRF - Arbitrary Database Query Attempt
id: 7c94e293-4b0f-4b1c-8f8e-1a7c1c9d3e21
status: experimental
description: Detects HTTP requests to Emlog admin/ai.php with execute_tool and query_database parameters indicative of CVE-2026-73847 CSRF exploitation.
logsource:
  category: proxy
  product: generic
detection:
  selection_method:
    http.method: POST
    http.url|contains: /admin/ai.php
  selection_tool:
    http.url|contains:
      - 'action=execute_tool'
      - 'tool=query_database'
  selection_body:
    http.request.body|contains:
      - 'sql='
      - 'confirm_code='
  condition: selection_method and selection_tool and selection_body
fields:
  - src_ip
  - http.url
  - http.request.body
  - http.user_agent
falsepositives:
  - Legitimate administrator use of the AI Assistant query_database feature
level: high

YARA Rule

rule Emlog_CVE_2026_73847_CSRF_DB_Takeover
{
    meta:
        author = "Valters IT Threat Intelligence"
        description = "Detects HTTP request bodies and logs referencing Emlog admin/ai.php CSRF exploitation indicators"
        cve = "CVE-2026-73847"
        date = "2026-01-01"
    strings:
        $a = "admin/ai.php"
        $b = "execute_tool"
        $c = "query_database"
        $d = "confirm_code="
        $e = "pwd_hash"
        $f = "sql="
        $g = "user table"
    condition:
        any of ($a, $b, $c, $d) and any of ($e, $f, $g)
}

Suricata IDS Rule

alert http any any -> any any (msg:"ET WEB_SPECIFIC_APPS Emlog AI Assistant CSRF Database Query Attempt (CVE-2026-73847)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/admin/ai.php"; http.uri; content:"execute_tool"; http.client_body; content:"query_database"; http.client_body; content:"sql="; http.client_body; content:"confirm_code="; classtype:web-application-attack; sid:2026738471; rev:1; priority:1;)

Elastic Detection

network where http.request.method == "POST"
  and url.path == "/admin/ai.php"
  and (url.query like "*execute_tool*" or url.query like "*query_database*")
  and (http.request.body like "*sql=*" or http.request.body like "*confirm_code=*")

Splunk SPL Query

index=web sourcetype=access_combined method=POST uri_path=/admin/ai.php
| eval exploit_signal = if(match(uri_query,"execute_tool") OR match(form_data,"query_database"), 1, 0)
| where exploit_signal=1
| table _time src_ip dest_ip uri uri_query form_data user_agent
| sort - _time

Wazuh OSSEC Rule

<group name="web_application,">
  <rule id="100738" level="12">
    <decoded>web</decoded>
    <match>admin/ai.php</match>
    <regex>execute_tool|query_database|confirm_code=|pwd_hash</regex>
    <description>Possible Emlog CVE-2026-73847 AI Assistant CSRF database takeover attempt</description>
    <mitre>
      <id>T1189</id>
    </mitre>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No vendor patch or fixed Emlog version has been identified as of this review. The following mitigations should be applied immediately.

1. Immediate mitigations

   • Disable the AI Assistant feature or block access to admin/ai.php at the web server or WAF layer until a patch becomes available.
   • Enforce an explicit SameSite=Strict or SameSite=Lax attribute on the authentication cookie in include/lib/loginauth.php. This reduces the effectiveness of cross-site forged POST requests.
   • Implement additional CSRF protections, such as checking the Origin and Referer headers on all admin/ai.php requests.
   • Require multi-factor authentication for administrator accounts so that a hijacked session alone is not enough for full account takeover.
   • Restrict administrative interface access to trusted IP addresses or VPN connections.

2. Patch / upgrade steps

   • Monitor the Emlog project for a security release. No fixed version is currently available.
   • Before upgrading, back up the database and application files.
   • Apply any vendor-issued mitigation instructions immediately when released.

3. Long-term hardening

   • Review and restrict database account privileges used by the Emlog application. The application should not need broad write access to all tables.
   • Add CSRF tokens to all state-changing administrative actions.
   • Remove or disable unused administrative features, including the AI Assistant if not required.
   • Deploy a web application firewall with rules to block /admin/ai.php requests containing execute_tool, query_database, and sql= parameters from non-admin contexts.
   • Audit the Emlog database for unauthorized changes to the user table, especially password hash modifications.

References

• NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-73847
• CWE-352: https://cwe.mitre.org/data/definitions/352.html
• Emlog Project: https://www.emlog.net/
• MITRE ATT&CK Drive-by Compromise: https://attack.mitre.org/techniques/T1189/

No known threat actor campaigns, public exploit code, or in-the-wild exploitation evidence was identified at the time of this review. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities catalog.