DWSurvey Incorrect Access Control Vulnerability Allowing Unauthorized Deletion of Questionnaires

An incorrect access control vulnerability has been identified in DWSurvey version 6.14.0. This issue allows users to delete questionnaires by manipulating the questionnaire ID in the deletion request. When the ID of a different questionnaire is substituted, it can result in the unauthorized deletion of that questionnaire.

Impact

Exploitation of this vulnerability allows for the unauthorized deletion of questionnaires, potentially leading to data loss.

Reproduction

To reproduce this vulnerability, first ensure that DWSurvey version 6.14.0 is running. Begin by creating two questionnaires in the system. Note the IDs of both questionnaires. Click the edit button on the first questionnaire to retrieve its ID. Then, click the delete button for the first questionnaire. When prompted, replace the ID with the ID of the second questionnaire. Upon confirmation, the second questionnaire will be deleted, demonstrating the access control flaw.