Executive brief
ObjectPlanet Opinio is a web-based survey platform used to create and manage online surveys and collect responses. A stored cross-site scripting vulnerability in the survey import feature allows an attacker to inject malicious JavaScript code that executes in the browsers of anyone viewing the compromised survey, potentially enabling session hijacking, credential theft, or malware distribution.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in the survey-import feature of ObjectPlanet Opinio 7.26 rev12562, where user-supplied input from imported survey data is not properly sanitized or encoded before being stored and displayed to other users. An attacker can craft a malicious survey file with embedded JavaScript that, when imported, gets stored in the application database and executed in the browsing context of any visitor accessing the compromised survey. The vulnerability requires an authenticated user with survey import privileges to upload the malicious survey file. This was addressed in version 7.27 with security enhancements related to XSS prevention and updates to the CKEditor library (4.22.1) and jQuery UI library (1.14.1).
Affected products
- ObjectPlanet Opinio 7.26 rev12562 and earlier
Timeline
- 2025-12-02: disclosed
- 2025-07-31: patched: Fixed in version 7.27 with XSS security enhancements