PT-2015-6644 · Limesurvey · Limesurvey

0Keeteam · Published 2015-06-18 · Updated 2016-12-07 · CVE-2015-4628

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions LimeSurvey versions prior to 2.06+ Build 150618

Description The issue allows remote authenticated administrators to execute arbitrary SQL commands. This is achieved via the sid parameter in the application/controllers/admin/questiongroups.php file.

Recommendations For versions prior to 2.06+ Build 150618, update to version 2.06+ Build 150618 or later to resolve the issue.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2015-4628

Affected Products

Limesurvey

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2015-4628 · Security Note
• https://github.com/LimeSurvey/LimeSurvey/commit/e15861a65b7028adfc23ef6af8563f645e318548 · Note
• https://github.com/LimeSurvey/LimeSurvey/commit/b09edc0dbd18d8459ade4c7c941e562c16564f9e · Note
• https://github.com/LimeSurvey/LimeSurvey/pull/331 · Note
• http://securityfocus.com/bid/75301 · Note
• https://bugs.limesurvey.org/view.php?id=9694 · Note