CVE-2026-50636

Name of the Vulnerable Software and Affected Versions LimeSurvey (affected versions not specified)

Description Remote authenticated attackers with tokens/update permissions on a survey can perform SQL injection through the RemoteControl API. The invite participants and remind participants endpoints pass a caller-supplied token-ID array to the findUninvited() function, which concatenates values directly into a SQL tid IN ('...') clause without validation or parameterization. Due to the use of emulated prepared statements and enabled MySQL multi-statements, the system is susceptible to stacked queries. This allows attackers to execute arbitrary SQL commands such as INSERT, UPDATE, DELETE, DROP, or CREATE. Consequently, an attacker can read sensitive data—including administrator bcrypt password hashes from lime users, personally identifiable information (PII) from survey responses, session records, and global settings—using a time-based blind oracle via the SLEEP() function. It also enables the modification or destruction of data, such as overwriting administrator passwords for account takeover or truncating tables. This issue requires the RemoteControl interface (RPCInterface = json/xml) to be enabled.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary mitigation, disable the RemoteControl interface (RPCInterface) by ensuring it is not set to json or xml.