LimeSurvey Stored Cross-Site Scripting Vulnerability in Survey Menu

A stored cross-site scripting vulnerability has been identified in LimeSurvey version 4.3.10 within the Survey Menu feature of the administration panel. This vulnerability allows attackers to inject malicious SVG scripts through the Surveymenu[title] and Surveymenu[parent_id] parameters, enabling the execution of arbitrary JavaScript in administrative contexts.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the survey menu.

Reproduction

To reproduce this vulnerability, first create a survey menu by sending a POST request to the admin menus update endpoint. Include an XSS payload in the Surveymenu[title] parameter. After the menu is created, send another POST request to the same endpoint, this time including the ID of the newly created menu in the Surveymenu[parent_id] parameter. The injected script will be executed when the menu is accessed.

Remediation

Users can update to LimeSurvey version 4.3.12 or later, where this vulnerability has been fixed.