Description

SQL injection vulnerability in application/controllers/admin/questiongroups.php in LimeSurvey before 2.06+ Build 150618 allows remote authenticated administrators to execute arbitrary SQL commands via the sid parameter.

Remediation

References

CVE-2015-4628

Related Vulnerabilities

WordPress Plugin Popup, Optin Form & Email Newsletters for Mailchimp, HubSpot, Aweber-MailOptin Security Bypass (1.2.49.0)

Dolibarr Files or Directories Accessible to External Parties Vulnerability (CVE-2023-33568)

WordPress Plugin BuddyBoss Media Cross-Site Scripting (3.2.3)

PHP-Fusion Authentication Bypass by Capture-replay Vulnerability (CVE-2020-23178)

WordPress Plugin WP Fastest Cache Cross-Site Request Forgery (0.9.0.2)

Severity

Medium

Tags

Missing Update Known Vulnerabilities CWE-138 CVE-2015-4628