The LimeSurvey Fund-Raiser 2012 is complete. Thank you for donating a total of 25,000 USD!     List of donors »
Welcome, Guest
Username: Password: Remember me
Forgot your password? Forgot your username?
  • Page:
  • 1

TOPIC: How secure is LimeSurvey? Injection attacks | File inclusion | Security

How secure is LimeSurvey? Injection attacks | File inclusion | Security 8 months 2 weeks ago #85212

  • Mike1985
  • Mike1985's Avatar
  • OFFLINE
  • Senior Lime
  • Posts: 49
  • Karma: 0
How secure is LimeSurvey with regards to SQL injection attacks etc? I found this online;

http://cxsecurity.com/issue/WLB-2012070061

it looks like the $homedir has not been checked in this case. Something similar here;

http://bot24.blogspot.co.uk/2012/06/limesurvey-192-build120620-multiple.html#!/2012/06/limesurvey-192-build120620-multiple.html

I've checked the bug tracker but can't find any mention of these. They're relevant to the latest release.

Are there any other security issues out there we should be aware of?

Thanks

Mike
The administrator has disabled public write access.

Re: How secure is LimeSurvey? Injection attacks | File inclusion | Security 8 months 2 weeks ago #85213

  • mdekker
  • mdekker's Avatar
  • NOW ONLINE
  • LimeSurvey Team
  • Posts: 254
  • Thank you received: 40
  • Karma: 25
Please report these issues in our bugtracker so one of the developers can take care of it.
---
Menno Dekker
The administrator has disabled public write access.

Re: How secure is LimeSurvey? Injection attacks | File inclusion | Security 8 months 2 weeks ago #85215

  • Mike1985
  • Mike1985's Avatar
  • OFFLINE
  • Senior Lime
  • Posts: 49
  • Karma: 0
I've managed to trace that first issue back and it seems it is secure.

That second one though...... I don't even know what it does, so I'm reluctant to open a bugtracker.
The administrator has disabled public write access.
  • Page:
  • 1
Moderators: DenisChenu, ITEd
Time to create page: 0.165 seconds
Donation Image