PT-2015-6644 · Limesurvey · Limesurvey

0Keeteam · Publicado 2015-06-18 · Atualizado 2016-12-07 · CVE-2015-4628

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions LimeSurvey versions prior to 2.06+ Build 150618

Description The issue allows remote authenticated administrators to execute arbitrary SQL commands. This is achieved via the sid parameter in the application/controllers/admin/questiongroups.php file.

Recommendations For versions prior to 2.06+ Build 150618, update to version 2.06+ Build 150618 or later to resolve the issue.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2015-4628

Produtos afetados

Limesurvey

Referências · 6

• https://github.com/LimeSurvey/LimeSurvey/commit/e15861a65b7028adfc23ef6af8563f645e318548 · Nota
• https://github.com/LimeSurvey/LimeSurvey/commit/b09edc0dbd18d8459ade4c7c941e562c16564f9e · Nota
• https://github.com/LimeSurvey/LimeSurvey/pull/331 · Nota
• http://securityfocus.com/bid/75301 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-4628 · Nota de Segurança
• https://bugs.limesurvey.org/view.php?id=9694 · Nota