CVE-2024-6933
📋 TL;DR
This CVE describes a SQL injection vulnerability in LimeSurvey's survey general settings handler. Attackers can remotely exploit this flaw by manipulating language parameters to execute arbitrary SQL commands. Organizations running LimeSurvey 6.5.14-240624 are affected.
💻 Affected Systems
- LimeSurvey
📦 What is this software?
Limesurvey by Limesurvey
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise allowing data theft, modification, or deletion; potential privilege escalation to system-level access.
Likely Case
Unauthorized data access, survey manipulation, or extraction of sensitive information from the LimeSurvey database.
If Mitigated
Limited impact due to proper input validation and database permissions, potentially only affecting non-sensitive survey data.
🎯 Exploit Status
Exploit details are publicly available; requires admin access to the survey general settings handler.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.6.2+240827
Vendor Advisory: https://community.limesurvey.org/downloads/
Restart Required: Yes
Instructions:
1. Backup your LimeSurvey installation and database. 2. Download version 6.6.2+240827 from the official LimeSurvey website. 3. Replace the affected files with the patched version. 4. Restart the web server service.
🔧 Temporary Workarounds
Input Validation Filter
allImplement custom input validation for the Language parameter in the survey general settings handler.
WAF Rule
allDeploy a web application firewall rule to block SQL injection attempts targeting the vulnerable endpoint.
🧯 If You Can't Patch
- Restrict access to the admin interface using network segmentation or IP whitelisting.
- Implement database-level controls to limit permissions for the LimeSurvey application user.
🔍 How to Verify
Check if Vulnerable:
Check the LimeSurvey version in the admin panel or by examining the application files for version 6.5.14-240624.Check Version:
Check the LimeSurvey admin dashboard or examine the application's version file if available.Verify Fix Applied:
Verify the installed version is 6.6.2+240827 and check the commit hash d656d2c7980b7642560977f4780e64533a68e13d is present.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts to admin interface
- Unexpected parameter values in /index.php?r=admin/database/index/updatesurveylocalesettings_generalsettings requests
Network Indicators:
- HTTP POST requests with SQL injection patterns in the Language parameter
- Traffic spikes to the vulnerable endpoint
SIEM Query:
source="web_server" AND uri="*updatesurveylocalesettings_generalsettings*" AND (param="*Language*" AND value="*' OR *")🔗 References
- https://community.limesurvey.org/downloads/
- https://github.com/Hebing123/cve/issues/55
- https://github.com/LimeSurvey/LimeSurvey/commit/d656d2c7980b7642560977f4780e64533a68e13d
- https://vuldb.com/?ctiid.271988
- https://vuldb.com/?id.271988
- https://vuldb.com/?submit.372007
- https://github.com/Hebing123/cve/issues/55
- https://vuldb.com/?ctiid.271988
- https://vuldb.com/?id.271988
- https://vuldb.com/?submit.372007
