CVE-2025-56421: LimeSurvey SQL Injection Vulnerability
Summary
CVE-2025-56421: LimeSurvey is vulnerable to SQL injection. Affects limesurvey/limesurvey versions < 6.15.4. Fixed in 6.15.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
LimeSurvey is an open-source online survey application that enables users to create, manage, and analyze surveys. It is widely used for academic research, market research, and feedback collection due to its user-friendly interface and robust features. However, prior to version 6.15.4, LimeSurvey is susceptible to SQL injection attacks, which can compromise the integrity and confidentiality of the database.
Vulnerability Detail
The SQL injection vulnerability in LimeSurvey versions before 6.15.4 allows remote attackers to manipulate SQL queries by injecting malicious code. This can lead to unauthorized access to sensitive information stored in the database, including user data and survey responses. The vulnerability arises from insufficient input validation, making it possible for attackers to execute arbitrary SQL commands.
How To Fix
Minimum fixed version
6.15.4
This is the first release that contains the fix.
composer require limesurvey/limesurvey:6.15.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not possible, consider implementing input validation and sanitization measures to mitigate the risk of SQL injection. Additionally, restrict database permissions for the web application to limit potential damage from an attack.
Conclusion
The SQL injection vulnerability in LimeSurvey prior to version 6.15.4 poses a significant risk to users and their data. It is crucial to update to the latest version to safeguard against potential attacks. Implementing best practices for input validation and database permissions can provide additional layers of security.
See every vulnerability recorded for limesurvey/limesurvey →
FAQ
SQL injection is a type of security vulnerability that allows an attacker to interfere with the queries that an application makes to its database. It can allow attackers to view data that they are not normally able to retrieve.
You can check your LimeSurvey version against the patched version (6.15.4 or later). Additionally, you can use Vulert's playground at Vulert Scanner to monitor and alert for vulnerabilities in your application.
If exploited, this vulnerability can lead to unauthorized access to sensitive data, data breaches, and potential loss of user trust.
Yes, implementing input validation and restricting database permissions can help mitigate the risk until you can update to a secure version.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for limesurvey/limesurvey.
