PT-2015-6770 · Limesurvey · Limesurvey

Published 2015-06-28 · Updated 2016-12-07 · CVE-2015-5078

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions LimeSurvey versions 2.06 and later

Description The issue allows remote authenticated users to execute arbitrary SQL commands via the closedate parameter in the insert function in application/controllers/admin/dataentry.php.

Recommendations For LimeSurvey versions 2.06 and later, update to a version that includes a fix for this issue, as using the closedate parameter can lead to execution of arbitrary SQL commands.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2015-5078

Affected Products

Limesurvey

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2015-5078 · Security Note
• https://github.com/LimeSurvey/LimeSurvey/commit/65d717415a271242b9a30a5330d4eabac1c1a837 · Note
• http://securityfocus.com/bid/75440 · Note
• https://bugs.limesurvey.org/view.php?id=9720 · Note
• https://bugs.limesurvey.org/plugin.php?page=Source/view&id=15509 · Note