LimeSurvey 3.21.1 is affected by cross-site scripting (XSS) in the Quota component of the Survey page. When the survey quota being viewed, e.g. by an administrative user, the JavaScript code will be executed in the browser.
LimeSurvey 3.21.1 is vulnerable to a cross-site scripting (XSS) attack, allowing attackers to inject malicious JavaScript code into the survey quota component. This can lead to account compromise, data theft, and website defacement by executing arbitrary code within the context of a legitimate user's browser, particularly administrators.
Step 1: Payload Delivery: An attacker crafts a malicious payload (JavaScript code) designed to exploit the XSS vulnerability. This payload is injected into the survey quota settings, likely through a crafted URL or by exploiting a related vulnerability that allows modification of quota configurations. Step 2: Payload Storage: The malicious payload is stored within the LimeSurvey database as part of the survey quota configuration. Step 3: Victim Interaction: An administrative user, or any user with sufficient privileges to view the survey quota, accesses the survey quota page within LimeSurvey. This action triggers the rendering of the quota information. Step 4: Payload Execution: The vulnerable quota component retrieves the malicious payload from the database and renders it in the user's browser. Because the input was not properly sanitized, the browser executes the injected JavaScript code. Step 5: Exploitation: The executed JavaScript code can perform various malicious actions, such as stealing the user's session cookies, redirecting the user to a phishing site, defacing the website, or executing arbitrary code within the user's browser context.
The vulnerability stems from insufficient input validation and output encoding within the LimeSurvey application, specifically within the quota management functionality. The application fails to properly sanitize user-supplied input related to quota settings before rendering it in the survey quota view. This allows an attacker to inject malicious JavaScript code into the quota configuration, which is then executed when an administrative user views the survey quota page. The root cause is a lack of proper input validation and output encoding (e.g., HTML escaping) of user-provided data within the quota component. This allows the attacker to inject malicious JavaScript code that is then rendered by the browser.