Authenticated SQL Injection in LimeSurvey 7.0.5 CPDB (CVE-2026-18403)

Vulnerability Overview Vulnerability Name: LimeSurvey Community Edition 7.0.5 - Authenticated SQL injection in CPDB Vulnerability Type: SQL Injection CVSS v4.0 Base Score: 6.0 CVE ID(s): CVE-2026-18403 Description: LimeSurvey Community Edition 7.0.5 contains an authenticated SQL injection vulnerability in the Central Participant Database (CPDB) workflow, which copies survey participant tokens to the central participant list. An authenticated low-privilege user with access to the participant panel can submit a crafted token to the CPDB attribute mapping. The mapped value is used as a raw SQL SELECT expression against the survey token table. The SQL expression result is subsequently persisted to and can be retrieved via the normal participant JSON endpoint when the target CPDB attribute is visible. Scope of Impact Affected Product: LimeSurvey Affected Version: 7.0.5 Fixed Version: 7.0.10 Exploitation Prerequisites: An authenticated low-privilege user with access to the participant panel. Potential Impact: - Extract sensitive data from the application database, including admin usernames and password hashes. - Read sensitive survey, participant, and administration database data. - Read credential hashes suitable for offline cracking. - Modify existing records in if the attacker controls the mapping key. Remediation Fixed Version: Upgrade to LimeSurvey 7.0.10 or later. Proof of Concept (PoC) Code Prerequisites LimeSurvey Community Edition 7.0.5 MySQL or MariaDB backend Application accessible at An authenticated user with access to the participant controller. The submitted PoC utilizes the following permissions: - - - A visible CPDB attribute capable of storing SQL expression results. Survey participant tokens selected via the token-to-CPDB mapping workflow. Reproduction Summary 1. Deploy LimeSurvey 7.0.5. 2. Create a restricted attacker account. 3. Grant the attacker account and sufficient permissions to create a self-contained test survey and log in locally. 4. Create a visible CPDB attribute. 5. Log in as the attacker account. 6. Create a survey and survey participant tokens via normal LimeSurvey endpoints. 7. Call: With: This stores the token ID in the server-side session value. 8. Call: Using normal parameters to create or associate the CPDB participant. 9. Call the same endpoint again, using and a malicious mapped value: 10. Call: And inspect the visible attribute cells in the JSON response. Expected Result The malicious mapped value is evaluated as an SQL expression. The expression result is persisted as a CPDB participant attribute. The JSON response contains rows from . Evidence Video Evidence: Contains a video of the exploit in action. Static Evidence: Contains screenshots of the exploit in action. --- The above is a summary of key information regarding the authenticated SQL injection vulnerability found in LimeSurvey Community Edition 7.0.5.

Goal Reached Thanks to every supporter — we hit 100%!

Authenticated SQL Injection in LimeSurvey 7.0.5 CPDB (CVE-2026-18403)