Skip to content
OpenAdvisories
Unscored Public exploit CVE-2021-44967 EUVD-2021-31765GHSA-58c2-r57v-99r7

A Remote Code Execution (RCE) vulnerabilty exists in LimeSurvey 5.2.4 via the upload and install plugins function, which could let a remote…

Published Feb 22, 2022 · Updated Feb 20, 2025 · Assigned by mitre

Description

A Remote Code Execution (RCE) vulnerabilty exists in LimeSurvey 5.2.4 via the upload and install plugins function, which could let a remote malicious user upload an arbitrary PHP code file. NOTE: the Supplier's position is that plugins intentionally can contain arbitrary PHP code, and can only be installed by a superadmin, and therefore the security model is not violated by this finding.

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 3 repositories

  • D3Ext/CVE-2021-44967 ★ 6 · Jan 5, 2025

    POC exploit for CVE-2021-44967

  • monke443/CVE-2021-44967 ★ 1 · Apr 18, 2025

    Authenticated (privileged) remote command execution in LimeSurvey Version 5.2.4 via upload and install plugins allows a remote user to upload arbitrary PHP code file.

  • godylockz/CVE-2021-44967 ★ 1 · Feb 17, 2025

    Proof of concept for CVE-2021-44967: LimeSurvey authenticated RCE

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References