CVE-2025-63248
📋 TL;DR
DWSurvey 6.14.0 has an access control vulnerability that allows authenticated users to delete other users' questionnaires by manipulating questionnaire IDs during deletion requests. This affects all DWSurvey 6.14.0 installations where users can delete questionnaires.
💻 Affected Systems
- DWSurvey
📦 What is this software?
Dwsurvey by Diaowen
⚠️ Risk & Real-World Impact
Worst Case
Malicious or compromised users could delete all questionnaires in the system, causing complete data loss and service disruption.
Likely Case
Users accidentally or intentionally delete other users' questionnaires, leading to data loss and potential business impact.
If Mitigated
With proper access controls, users can only delete their own questionnaires, limiting impact to authorized data.
🎯 Exploit Status
Exploitation requires authenticated access but is simple - just modify questionnaire ID parameter in deletion requests.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Unknown
Restart Required: No
Instructions:
No official patch available. Check vendor repositories for updates or implement workarounds.
🔧 Temporary Workarounds
Implement server-side authorization check
allAdd server-side validation to ensure users can only delete questionnaires they own
Modify questionnaire deletion endpoint to verify ownership before processing
Disable questionnaire deletion
allTemporarily disable questionnaire deletion functionality
Comment out or remove questionnaire deletion endpoints
🧯 If You Can't Patch
- Implement web application firewall rules to block suspicious deletion requests
- Enable detailed logging of all questionnaire deletion attempts and monitor for unauthorized access
🔍 How to Verify
Check if Vulnerable:
Test by creating two questionnaires with different IDs, then attempt to delete one by substituting the other's ID in the deletion request.Check Version:
Check DWSurvey version in application interface or configuration filesVerify Fix Applied:
After implementing fixes, repeat the test - deletion should fail when attempting to delete another user's questionnaire.📡 Detection & Monitoring
Log Indicators:
- Multiple failed deletion attempts
- Deletion requests for questionnaire IDs not owned by requesting user
- Unusual deletion patterns
Network Indicators:
- HTTP POST requests to questionnaire deletion endpoints with modified ID parameters
SIEM Query:
source="dwsurvey" AND action="delete" AND user_id!=questionnaire_owner_id