Executive brief
LimeSurvey, a popular open-source survey platform, contains a security flaw in its remote management interface. An authenticated user with basic survey permissions can exploit this to gain full control over the database. This could lead to the theft of sensitive participant data, exposure of administrator passwords, or the complete deletion of survey records.
Technical details
A SQL injection vulnerability exists in LimeSurvey's RemoteControl API within the invite_participants and remind_participants methods. The root cause is the lack of input validation or parameterization when passing a caller-supplied token-ID array into the TokenDynamic::findUninvited() function, which directly concatenates values into a 'tid IN' SQL clause. Because the application uses PDO with emulated prepared statements (emulatePrepare = true) and does not disable multi-statements, attackers can perform stacked queries. This allows remote, authenticated attackers with 'tokens/update' permissions to read sensitive data (like bcrypt hashes in the lime_users table) via time-based blind techniques or perform arbitrary write/delete operations. The attack requires the RemoteControl interface (JSON/XML) to be enabled.
Affected products
- LimeSurvey LimeSurvey <= 7.0.0-beta1
Timeline
- 2026-06-04: other: Fix submitted via pull request 5031
- 2026-06-09: disclosed: Initial advisory publication
- 2026-06-09: advisory: GitHub Advisory GHSA-pr6f-87hf-hx24 published
References
- https://github.com/LimeSurvey/LimeSurvey/pull/5031
- https://www.limesurvey.org/
- https://www.vulncheck.com/advisories/limesurvey-remotecontrol-invite-participants-remind-participants-sql-injection
- https://github.com/LimeSurvey/LimeSurvey/commit/4f383aa0bbe711f0064b319edb19fba759c50a33
- https://github.com/LimeSurvey/LimeSurvey/commit/98cfee55df97f9c82a72cf352bb204d51e588f7e