CVE-2018-1000658: Malicious File Upload
LimeSurvey version prior to 3.14.4 contains a file upload vulnerability in upload functionality that can result in an attacker gaining code execution via webshell. This attack appear to be exploitable via an authenticated user uploading a zip archive which can contains malicious php files that can be called under certain circumstances. This vulnerability appears to have been fixed in after commit 91d143230eb357260a19c8424b3005deb49a47f7 / version 3.14.4.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2018-1000658?
The severity of CVE-2018-1000658 is high with a severity value of 8.8.
How does the vulnerability in LimeSurvey version prior to 3.14.4 affect the software?
The vulnerability in LimeSurvey version prior to 3.14.4 allows an attacker to gain code execution via webshell by uploading a zip archive containing malicious PHP files.
How can an attacker exploit CVE-2018-1000658?
An attacker can exploit CVE-2018-1000658 by uploading a zip archive containing malicious PHP files.
Is authentication required to exploit the vulnerability in LimeSurvey version prior to 3.14.4?
Yes, authentication is required for an attacker to exploit the vulnerability in LimeSurvey version prior to 3.14.4.
Is there a fix available for CVE-2018-1000658?
Yes, updating to LimeSurvey version 3.14.4 or later fixes the vulnerability.