Sql injection

2012-09-1517:55:00

PRIOn knowledge base

www.prio-n.com

9.1 High

AI Score

Confidence

Low

0.003 Low

EPSS

Percentile

71.5%

JSON

SQL injection vulnerability in Limesurvey (a.k.a PHPSurveyor) before 1.91+ Build 120224 and earlier allows remote attackers to execute arbitrary SQL commands via the fieldnames parameter to index.php.

CPENameOperatorVersion
limesurveyeq1.80.0
limesurveyeq1.70
limesurveyeq1.52
limesurveyeq1.49 rc2
limesurveyeq1.81.0
limesurveyeq1.81
limesurveyeq1.80 rc4
limesurveyeq<= 1.90
limesurveyeq1.49.0-rc2
limesurveyeq1.5.2

Name	Operator	Version
limesurvey	eq	1.80.0
limesurvey	eq	1.70
limesurvey	eq	1.52
limesurvey	eq	1.49 rc2
limesurvey	eq	1.81.0
limesurvey	eq	1.81
limesurvey	eq	1.80 rc4
limesurvey	eq	<= 1.90
limesurvey	eq	1.49.0-rc2
limesurvey	eq	1.5.2

Rows per page:

1-10 of 121

References

freecode.com/projects/limesurvey/releases/342070

osvdb.org/79459

packetstormsecurity.org/files/110100/limesurvey-sql.txt

secunia.com/advisories/48051

www.limesurvey.org/en/stable-release

www.securityfocus.com/bid/52114

exchange.xforce.ibmcloud.com/vulnerabilities/73395

www.exploit-db.com/exploits/18508