LimeSurvey vulnerabilities

A deserialization vulnerability in LimeSurvey before v6.15.0+250623 allows a remote attacker to execute arbitrary code on the server.

An authenticated LimeSurvey Community Edition 7.4.0 user with the global Surveys: create permission can store a JavaScript-breaking value in the date_min attribute of a Date/Time question. When another user renders the affected question, LimeSurvey inserts the stored value into a single-quoted inline JavaScript literal without JavaScript-context encoding.

In LimeSurvey Community Edition 7.3.0, an authenticated user allowed to create surveys can use their own survey as an authorized context while supplying question or answer identifiers belonging to another user's survey. The REST survey-patching endpoint checks the attacker's permission against the survey ID in the request URL, but the vulnerable persistence operations resolve the target object independently by its global qid or aid and never verify that it belongs to that authorized survey.

LimeSurvey Community Edition 7.0.14 contains a reflected cross-site scripting vulnerability on the administrative survey-participant CSV import result page.

LimeSurvey Community Edition 7.0.14 fails to safely encode attacker-controlled content from a crafted .lss survey file when displaying import warnings, resulting in XSS in the administrative interface.

LimeSurvey Community Edition 7.0.5 contains an improper authorization vulnerability in the survey menu entry creation endpoint. An authenticated user with only global settings:read permission can directly invoke POST /index.php/admin/menuentries/sa/create and create new survey menu entries without the expected settings:update privilege. The endpoint also allows the attacker to submit menu IDs that the normal interface restricts for non-superadministrators, enabling unauthorized changes to administrative navigation records.

LimeSurvey Community Edition 7.0.5 contains an authenticated stored cross-site scripting vulnerability in the replacement-fields dialog used by the administrative question editor. This issue affects LimeSurvey 7.0.5.

LimeSurvey Community Edition 7.0.5+260623 contains an authenticated reflected Cross-Site Scripting vulnerability in the user activation confirmation endpoint. The 'action' query parameter is copied into the response and inserted into a hidden input attribute without HTML attribute encoding.

LimeSurvey Community Edition 7.0.5 contains a stored cross-site scripting vulnerability in the survey quota creation workflow. An authenticated low-privileged user who can create and manage their own survey can store malicious JavaScript in a quota message.

LimeSurvey Community Edition 7.0.5 contains a stored cross-site scripting vulnerability in the Survey Menu Entries admin page. An authenticated user with global settings:read permission can create a survey menu entry with attacker-controlled data. The value is stored and later inserted into a single-quoted HTML title attribute without proper encoding.

LimeSurvey Community Edition 7.0.5 contains an authenticated SQL injection vulnerability in the Central Participant Database (CPDB) workflow that copies survey participant tokens to the central participant list.

LimeSurvey Community Edition 7.0.5 contains an authenticated reflected cross-site scripting vulnerability in the HTML editor popup endpoint. The text and name query parameters are passed through a blacklist sanitizer and then rendered without context-appropriate output encoding.

LimeSurvey up to versions 6.17.10 and 7.0.4 contains an SSRF vulnerability in the REST API survey template endpoint. Authenticated users can manipulate the Host header, causing the server to issue arbitrary HTTP requests, enabling access to internal network services and cloud metadata endpoints.

SQL Injection vulnerability in LimeSurvey RemoteControl API methods (invite_participants and remind_participants). An attacker with tokens/update permission can inject SQL via unsanitized input. With RPCInterface enabled and emulated prepared statements, attacker can read admin password hashes and other data, and modify the database.

LimeSurvey constructs password-reset links from the client-supplied HTTP Host header without validating it. The optional allowedHosts allowlist is undefined in the default configuration, so LSHttpRequest::checkIsAllowedHost() results in no operation. A remote, unauthenticated attacker who submits a forgotten-password request for a known account with a spoofed Host header causes LimeSurvey to email a reset link with an attacker-controlled hostname while embedding the genuine validation_key. When the recipient or an automated inbound mail-security link scanner dereferences the link, the valid reset token is disclosed to the attacker, who replays it against the legitimate host's newPassword endpoint to set a new password and take over the account.

SQL Injection vulnerability in LimeSurvey before version 6.15.4+250710 allows a remote attacker to inject malicious SQL code into database queries. This can lead to unauthorized access to sensitive data stored in the database.

Cross Site Scripting (XSS) vulnerability in LimeSurvey before version 6.5.0+240319 allows a remote attacker to execute arbitrary JavaScript code in the victim's browser. The issue stems from missing input validation and output encoding in the Alert Widget's message component.

A Cross-Site Scripting (XSS) vulnerability was found in LimeSurvey before version 6.5.12+240611. A remote attacker can execute arbitrary code via a crafted script in the title and comment fields.

A cross-site scripting (XSS) vulnerability was found in LimeSurvey 3.6.2+180406 in the theme.php controller. Attackers can inject arbitrary web script or HTML via the changes_cp parameter in requests to the index.php/admin/themes/sa/templatesavechanges URI.