Emlog CMS Pro before version 2.6.16 contains a blind SQL injection in the function that retrieves user data. The vulnerability arises because the username extracted from the authentication cookie is concatenated directly into an SQL statement without sanitisation. The only guard is an HMAC signature that requires the server’s AUTH_KEY, so an attacker would need to forge the cookie or have the key. Successful exploitation could allow extraction or manipulation of database records, resulting in data disclosure or modification.

The affected product is Emlog CMS Pro, version 2.6.15 and earlier. The issue is present in all builds that use the vulnerable User_Model module prior to the 2.6.16 release. No further vendor details are available beyond the emlog product.

The CVSS score of 4.9 indicates moderate severity. The vulnerability is a blind SQL injection, so exploitation requires iterative query timing or error analysis, which limits immediate impact. EPSS not available and the vulnerability is not listed in CISA KEV. Because forging the authentication cookie demands knowledge of the server’s AUTH_KEY, the risk to external attackers is low unless the key is compromised. Administrators should prioritize applying the 2.6.16 patch to eliminate the flaw.