LimeSurvey Community Edition 7.0.5 - Authenticated SQL injection in CPDB
6
Medium
Detected by
Fluid Attacks AI SAST Scanner
Disclosed by
Miguel Gómez
Summary
Full name
LimeSurvey Community Edition 7.0.5 - Authenticated SQL injection in CPDB token-to-participant attribute mapping
Code name
State
Public
Release date
Affected product
LimeSurvery
Vendor
LimeSurvery
Affected version(s)
7.0.5
Fixed version(s)
7.0.10
Vulnerability name
SQL injection
Vulnerability type
Remotely exploitable
Yes
CVSS v4.0 vector string
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS v4.0 base score
6.0
Exploit available
Yes
CVE ID(s)
Description
LimeSurvey Community Edition 7.0.5 contains an authenticated SQL injection vulnerability in the Central Participant Database (CPDB) workflow that copies survey participant tokens to the central participant list.
An authenticated low-privileged user with access to the participant panel can submit a crafted token-to-CPDB attribute mapping. The mapping value is used as a raw SQL SELECT expression against the survey token table. The SQL expression result is then persisted into lime_participant_attribute.value and can be retrieved through the normal participant JSON endpoint when the target CPDB attribute is visible.
The validated impact is sensitive data extraction from the application database, including administrator usernames and password hashes. The same code path also contains an unsafe update condition for lime_participant_attribute, but no arbitrary-table write or privilege escalation primitive was confirmed.
Vulnerability
Root cause
Controller-level permission is broader than the affected operation requires (
ParticipantsAction.php:54-65):A user with
participantpanel:readcan reach participant actions, including the affected mapping actions, without an additional operation-specific authorization check.The selected token ID is stored from attacker-controlled POST data (
ParticipantsAction.php:2674-2679):The
mappedarray is accepted directly from POST (ParticipantsAction.php:2494-2502):No allowlist verifies that each mapping value is a real token-table column name, and no numeric validation verifies that each mapping key is a legitimate CPDB attribute ID before the array reaches the model.
The model forwards attacker-controlled mapping values into the SQL sink (
Participant.php:2178-2181,Participant.php:2219-2222):The primary SQL injection sink is the raw SELECT expression (
Participant.php:2036-2042):$tokenFieldnameis attacker-controlled throughmapped[<attribute-id>]=<value>.Yii preserves attacker-controlled SQL expressions containing parentheses (
CDbCommand.php:604-625):Payloads such as
(SELECT GROUP_CONCAT(... ) FROM lime_users)are therefore not quoted as column names.The query result is persisted into a participant attribute (
Participant.php:2044-2066):The persisted value is exposed by a normal JSON endpoint (
ParticipantsAction.php:2216-2271):
Confirmed source-to-sink path
Source: authenticated POST request to:
Request parameter:
Controller:
ParticipantsAction::addToCentral()passesmappedtoParticipant::copyToCentral().Model flow:
Participant::copyToCentral()iterates over$aMapped.SQL sink:
Participant::updateAttributeValueToken()callsselect($tokenFieldname).Query builder behavior:
CDbCommand::select()preserves strings containing(as raw SELECT fragments.Persistence sink: the selected value is stored in
{{participant_attribute}}.value.Exfiltration sink:
ParticipantsAction::getParticipantsJson()returns visible CPDB attribute values.
Impact
An authenticated low-privileged user with participant panel access can evaluate SQL expressions in the context of the LimeSurvey database user and persist the result in a CPDB attribute visible through the application.
Confirmed impact from the submitted evidence:
Extraction of local LimeSurvey usernames and password hashes from
lime_users.Multi-row data aggregation using MySQL
GROUP_CONCAT.Delivery of the extracted result through the standard authenticated
getParticipantsJsonendpoint.
Potential impact:
Reading sensitive survey, participant, and administrative database data.
Reading credential hashes for offline cracking.
Modifying existing records in
lime_participant_attributethrough the secondary unsafe update condition if the attacker controls the mapping key:
PoC
Preconditions
LimeSurvey Community Edition
7.0.5+260623.MySQL or MariaDB backend.
Application reachable at
http://127.0.0.1:8081.An authenticated user with access to the participants controller. The submitted PoC used:
participantpanel:readsurveys:createauth_db:read
A visible CPDB attribute that can store the SQL expression result.
A survey participant token selected through the token-to-CPDB mapping workflow.
Reproduction Summary
Deploy LimeSurvey 7.0.5.
Create a constrained attacker account.
Grant the attacker account
participantpanel:readand enough permissions to create a self-contained test survey and log in locally.Create a visible CPDB attribute.
Login as the attacker account.
Create a survey and a survey participant token through normal LimeSurvey endpoints.
Call:
with:
This stores the token ID in the server-side
participantidsession value.Call:
once with normal parameters to create or associate the CPDB participant.
Call the same endpoint again with
overwriteman=1and a malicious mapping value:Call:
and inspect the visible attribute cell in the JSON response.
Expected result:
The malicious mapping value is evaluated as a SQL expression.
The expression result is persisted as a CPDB participant attribute.
The JSON response contains
username:password-hashrows fromlime_users.
Evidence of Exploitation
Video of exploitation:
Static evidence:
Our security policy
We have reserved the ID CVE-2026-18403 to refer to this issue from now on.
System Information
LimeSurvey
Version: 7.0.5
Operating System: Any
References
GitHub Repository: https://github.com/LimeSurvey/LimeSurvey/
Patch: https://github.com/LimeSurvey/LimeSurvey/commit/7735ce31cea1cad087b0c8556cb65a1c09e29cbd
Mitigation
An updated version of LimeSurvey is available on the vendor page.
Credits
The vulnerability was discovered by Miguel Gomez from Fluid Attacks' Offensive Team using the AI SAST Scanner.
Timeline
Vulnerability discovered
Vendor contacted
Vendor replied
Vendor requested re-testing
Follow-up with vendor
Vendor confirmed
Vulnerability patched
Public disclosure
Does your application use this vulnerable software?
During our free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.
