PT-2022-12270 · Unknown · Limesurvey

Published 2022-02-22 · Updated 2026-01-28 · CVE-2021-44967

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions LimeSurvey version 5.2.4

Description A Remote Code Execution (RCE) issue exists via the upload and install plugins function, which could let a remote malicious user upload an arbitrary PHP code file.

Recommendations For LimeSurvey version 5.2.4, consider disabling the upload and install plugins function until a patch is available to prevent exploitation. Restrict access to the plugin installation feature to minimize the risk of uploading malicious PHP code files.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

BIT-LIMESURVEY-2021-44967

CVE-2021-44967

Affected Products

Limesurvey

References · 12

• 🔥 https://github.com/Y1LD1R1M-1337/Limesurvey-RCE · Exploit
• 🔥 https://exploit-db.com/exploits/50573 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-44967 · Security Note
• https://osv.dev/vulnerability/BIT-limesurvey-2021-44967 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-44967 · Vendor Advisory
• https://twitter.com/akaclandestine/status/2016538626671116318 · Twitter Post
• https://t.me/cvenotify/111847 · Telegram Post
• https://t.me/cvenotify/27270 · Telegram Post
• https://limesurvey.org/manual/Plugins_-_advanced · Note
• https://t.me/cybersecuritytechnologies/11647 · Telegram Post
• https://twitter.com/gothburz/status/1876053138378981469 · Twitter Post
• https://twitter.com/GREENSL31146133/status/2010784957975925140 · Twitter Post