CVE-2021-44967 PoC — LimeSurvey 代码问题漏洞

Source

https://github.com/monke443/CVE-2021-44967

Associated Vulnerability

Title: LimeSurvey 代码问题漏洞 (CVE-2021-44967)
Description:A Remote Code Execution (RCE) vulnerabilty exists in LimeSurvey 5.2.4 via the upload and install plugins function, which could let a remote malicious user upload an arbitrary PHP code file. NOTE: the Supplier's position is that plugins intentionally can contain arbitrary PHP code, and can only be installed by a superadmin, and therefore the security model is not violated by this finding.

Description

Authenticated (privileged) remote command execution in LimeSurvey Version 5.2.4 via upload and install plugins allows a remote user to upload arbitrary PHP code file.

Readme

# CVE-2021-44967 - Authenticated(privileged) RCE
Authenticated (privileged) remote command execution in LimeSurvey Version 5.2.4 via upload and install plugins allows a remote user to upload arbitrary PHP code file.


# Usage
`python3 exploit.py --url <http://example.com> --user <userName> --password <userPassword> --lhost <localHost> --lport <localPort>`

A superadmin user is allowed to load plugin modules through the LimeSurvey administration panel. The script locally creates the files, zips and uploads them. Later, a call is made to install, activate and run the modules, executing the reverse shell.




![image](https://github.com/user-attachments/assets/e28b12b1-e3db-43a3-9dfc-8429e6c79e88)

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →