EUVD-2025-209390
GHSA-5cw5-4v8j-xgrw
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
3Description
A Reflected Cross-Site Scripting (XSS) affects LimeSurvey versions prior to 6.15.11+250909, due to the lack of validation of gid parameter in getInstance() function in application/models/QuestionCreate.php. This allows an attacker to craft a malicious URL and compromise the logged in user.
Analysis
Reflected cross-site scripting in LimeSurvey prior to version 6.15.11+250909 allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser via a malicious URL containing an unsanitized gid parameter passed to the getInstance() function in QuestionCreate.php. The vulnerability requires user interaction (clicking a crafted link) but affects logged-in users and can lead to session hijacking, credential theft, or malicious actions performed on behalf of the victim. No public exploitation has been confirmed at time of analysis, though proof-of-concept code is publicly available.
Technical Context
LimeSurvey is a PHP-based survey application framework. The vulnerability stems from insufficient input validation in the getInstance() function within application/models/QuestionCreate.php, where the gid (group ID) parameter is reflected directly into the HTTP response without proper output encoding or sanitization. This is a classic reflected XSS vulnerability (CWE-79: Improper Neutralization of Input During Web Page Generation) where untrusted user input is rendered in HTML context without escaping. The attack vector is network-based with low complexity; the application accepts the parameter without validation and returns it in the response, allowing an attacker to inject malicious script payloads that execute in the victim's browser with their session privileges.
Affected Products
LimeSurvey versions prior to 6.15.11+250909 are affected. The specific CPE data provided in the input (cpe:2.3:a:n/a:n/a:*:*:*:*:*:*:*:*) does not contain valid vendor/product identification, but the advisory and commit reference indicate LimeSurvey products distributed through their official GitHub repository. Users running LimeSurvey 6.15.11 released on September 9, 2025, or later are not affected; earlier 6.15.x versions and all 6.14.x and prior releases require patching. Additional details are available via the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2025-63238.
Remediation
Upgrade LimeSurvey to version 6.15.11+250909 or later. The upstream fix is available in GitHub commit 80769a677dc82ddb1fcced4af19bd959d583208d, which implements proper input validation and output encoding for the gid parameter in the getInstance() function. Organizations unable to upgrade immediately should implement a web application firewall (WAF) rule to block requests containing suspicious characters in the gid parameter (such as script tags, quotes, or encoded payload variants) or restrict access to LimeSurvey administrative and survey creation interfaces to trusted networks. The NVD advisory at https://nvd.nist.gov/vuln/detail/CVE-2025-63238 provides additional remediation guidance.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today