Description
Cross-site scripting (XSS) vulnerability in admin/userrighthandling.php in LimeSurvey before 1.91+ Build 120224 allows remote attackers to inject arbitrary web script or HTML via the full_name parameter in a moduser action to admin/admin.php. NOTE: some of these details are obtained from third party information.
References
- 79687 vdb-entry
- limesurvey-fullname-xss(73563) vdb-entry
- http://www.limesurvey.org/en/stable-release
- http://freecode.com/projects/limesurvey/releases/342070
- 48184 third-party-advisory