SQL Injection Vulnerability in LimeSurvey Survey General Settings
CVE-2024-6933
Key Information:
- Vendor
LimeSurvey
- Status
- Vendor
- CVE Published:
- 21 July 2024
Badges
What is CVE-2024-6933?
A critical SQL injection vulnerability has been identified in LimeSurvey's Survey General Settings feature, specifically in the actionUpdateSurveyLocaleSettingsGeneralSettings function located within the /index.php?r=admin/database/index/updatesurveylocalesettings_generalsettings file. Exploiting this flaw allows remote attackers to manipulate the 'language' argument, potentially executing arbitrary SQL commands. This vulnerability poses a significant risk as it may grant unauthorized access to sensitive database information. The issue has been publicly disclosed, and as such, organizations using affected versions should take immediate action to secure their systems against potential exploits.
Affected Version(s)
LimeSurvey 6.5.14-240624
LimeSurvey 6.6.2+240827
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.