LimeSurvey Reflected Cross-Site Scripting Vulnerability

A reflected cross-site scripting vulnerability has been identified in LimeSurvey versions prior to 6.15.11+250909. The issue arises from inadequate validation of the 'gid' parameter in the 'getInstance()' function within 'application/models/QuestionCreate.php'. This vulnerability allows an attacker to create a malicious URL that can compromise the logged-in user.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, log into the LimeSurvey admin portal and create a survey to obtain its ID. Then, navigate to '/index.php/questionAdministration/create' and include the 'gid' parameter with a crafted script payload, along with the 'surveyid' parameter set to the ID of the created survey. Upon loading the page, the injected script will execute, demonstrating the cross-site scripting vulnerability.

Remediation

Users are advised to upgrade to LimeSurvey version 6.15.12+250916 or later.