Critical severity · published Jul 21, 2024
CVE-2024-6933
A flaw has been found in LimeSurvey 6.5.14-240624
9.8
CVSS
0.6%
EPSS
No
On KEV
Description
A flaw has been found in LimeSurvey 6.5.14-240624. Affected by this issue is the function actionUpdateSurveyLocaleSettingsGeneralSettings of the file /index.php?r=admin/database/index/updatesurveylocalesettings_generalsettings of the component Survey General Settings Handler. This manipulation of the argument Language causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used. Upgrading to version 6.6.2+240827 can resolve this issue. Patch name: d656d2c7980b7642560977f4780e64533a68e13d. You should upgrade the affected component.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 47% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
Limesurvey · Limesurvey
6.5.14 before 6.6.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-6933
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-6933
Product
https://community.limesurvey.org/downloads/
Exploit
https://github.com/Hebing123/cve/issues/55
Patch
https://github.com/LimeSurvey/LimeSurvey/commit/d656d2c7980b7642560977f4780e64533a68e13d
Permissions Required
https://vuldb.com/?ctiid.271988
Third Party Advisory
https://vuldb.com/?id.271988
Third Party Advisory
https://vuldb.com/?submit.372007
More from Limesurvey
9.8
CVE-2025-56422
A deserialization vulnerability in LimeSurvey before v6.15.0+250623 allows a remote attacker to execute arbitrary code on the server
9.8
CVE-2025-41375
SQL Injection vulnerability in Limesurvey v2.65.1+170522
9.8
CVE-2022-48008
An arbitrary file upload vulnerability in the plugin manager of LimeSurvey v5.4.15 allows attackers to execute arbitrary code via a crafted PHP file
9.8
CVE-2019-25019
LimeSurvey before 4.0.0-RC4 allows SQL injection via the participant model
9.8
CVE-2020-11455
LimeSurvey before 4.1.12+200324 contains a path traversal vulnerability in application/controllers/admin/LimeSurveyFileManager.php