CVE-2014-5017

Name of the Vulnerable Software and Affected Versions LimeSurvey versions 2.05 and later

Description The issue allows remote attackers to execute arbitrary SQL commands via the sidx parameter in a JSON request to "admin/participants/sa/getParticipants json", related to a search parameter. This is a SQL injection vulnerability in CPDB in application/controllers/admin/participantsaction.php.

Recommendations For LimeSurvey versions 2.05 and later, avoid using the sidx parameter in the "admin/participants/sa/getParticipants json" endpoint until the issue is resolved. As a temporary workaround, consider restricting access to the vulnerable CPDB module in application/controllers/admin/participantsaction.php to minimize the risk of exploitation.