PT-2024-30196 · Unknown · Limesurvey

Published 2024-09-03 · Updated 2025-07-04 · CVE-2024-42902

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions LimeSurvey versions 6.6.2 and earlier

Description An issue in the js localize.php function allows attackers to execute arbitrary code via injecting a crafted payload into the lng parameter. This enables potential remote code execution.

Recommendations For LimeSurvey versions 6.6.2 and earlier, update to the latest version to resolve the issue. As a temporary workaround, consider restricting access to the js localize.php function to minimize the risk of exploitation. Avoid using the lng parameter in the affected function until the issue is resolved.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BIT-LIMESURVEY-2024-42902

CVE-2024-42902

Affected Products

Limesurvey

References · 12

• 🔥 https://github.com/sysentr0py/CVEs/tree/main/CVE-2024-42902 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-42902 · Security Note
• https://osv.dev/vulnerability/BIT-limesurvey-2024-42902 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-42902 · Vendor Advisory
• https://github.com/LimeSurvey/LimeSurvey/blob/6434b12ded1c4b6516200c453441d0896e11eee0/vendor/kcfinder/js_localize.php#L19 · Note
• https://bugs.limesurvey.org/view.php?id=19639 · Note
• https://twitter.com/CVEnew/status/1831027227900751991 · Twitter Post
• https://t.me/cvenotify/127573 · Telegram Post
• https://twitter.com/oktsec/status/1831063800012853254 · Twitter Post
• https://t.me/cvedetector/4704 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1831074375681904747 · Twitter Post
• https://twitter.com/cracbot/status/1832660228669886770 · Twitter Post