LimeSurvey 6.13.0 Session Cookie Injection Vulnerability Leading to Internal Information Disclosure

A vulnerability in LimeSurvey version 6.13.0 allows external users to cause a 500 error by sending a malformed session cookie. This error response reveals internal backend details, including the Yii framework, MySQL/MariaDB database engine, the 'lime_sessions' table, primary keys, and fragments of the conflicting content. Such information could aid an attacker in understanding the application's internal architecture.

Impact

Exploitation of this vulnerability causes a 500 error, but not before disclosing sensitive internal information that could be used to understand the application's architecture and potentially exploit other vulnerabilities.

Remediation

Users can upgrade to LimeSurvey version 6.15.0 to address this vulnerability.