Tduck Survey Form
Monthly
Authenticated users of TDuck Survey Form through version 5.3 can hijack forms they do not own and redirect their submissions to arbitrary destinations, because WebhookConfigController enforces neither a form-ownership check nor any validation of the webhook URL. The result is a chained broken-access-control/IDOR plus server-side request forgery issue: a low-privilege account can point a victim's webhook at an external collector to exfiltrate form data, or at internal-only addresses to make the TDuck server issue requests on the attacker's behalf, producing high confidentiality impact with only limited integrity impact. Exploitation needs only a valid authenticated session (remote, no victim interaction beyond normal form submissions, no non-default configuration), and no public exploit code or confirmed active exploitation was identified at time of analysis.
This is a genuine but bounded-priority integrity flaw: in TDuck Survey Form through version 5.0, any authenticated low-privilege user can overwrite other respondents stored form submissions by calling POST /user/form/data/update with a submission identifier that does not belong to them, because the endpoint performs no ownership validation (CWE-639). Confidentiality and availability are unaffected, so the realistic impact is corruption or falsification of collected survey data, including responses containing personal information, rather than data theft or denial of service. Exploitation requires only a valid account (authenticated, PR:L) with no admin role, user interaction, or non-default configuration, and it is aided by submission identifiers being allocated in narrow, guessable ranges; no public exploit code has been identified at time of analysis and the issue is not reported as actively exploited.
Missing authorization in TDuck Survey Form through 5.3 allows any authenticated, low-privileged user to read another form owner's raw settings by calling GET /user/form/setting/{key} with the 8-character form key embedded in a public survey fill link. The endpoint returns the form write password, the owner's notification e-mail address and associated WeChat openIds, which can be chained into form tampering and targeted phishing; a valid account is required (CVSS PR:L, so risk is higher where self-service registration is open), no user interaction is needed, and no public exploit identified at time of analysis. Severity is modest rather than critical because disclosure is confined to per-form settings and the attacker must authenticate first.
Missing server-side enforcement of the write/submission password in TDuck survey form through 6.0 allows remote unauthenticated attackers to post form entries directly to the public submission API, because the password gate is implemented only in front-end JavaScript. An attacker only needs the form key that is exposed in any public share link; no account, no user interaction, and no special configuration are required. Publicly available exploit code exists (a Python PoC targeting the submission endpoint), but there is no indication of confirmed active exploitation (not in CISA KEV), and the impact is bounded to unauthorized submission injection - existing responses cannot be read and availability is unaffected.
Authenticated users who know a form's key can flood TDuck Survey Form through 6.0 with unlimited submissions via POST /user/form/data/create, because that endpoint never enforces the form's publish status, time window, quota, or per-IP limits - letting an attacker falsify or inflate collected survey results. The defect requires only a low-privileged TDuck account (CVSS 3.1 PR:L) plus the target form key, is remotely exploitable over HTTP with no user interaction, and is strictly an integrity issue: no confidential data can be read and no denial of service results. Publicly available exploit code exists (a bypass PoC script for the data-create endpoint), but there is no confirmed active exploitation and no CISA KEV listing; independent assessment rates this a genuine but low-severity authorization defect.
TDuck Survey Form 6.0 fails open in its form-ownership authorization check, letting an authenticated user read submission records that belong to forms which have been permanently deleted. An attacker who knows or can guess a dataId can call GET /user/form/data/details and retrieve the orphaned submission row, including personal information, because FormAuthUtils.hasPermission returns a permissive result when the parent form no longer exists; for live forms the ownership check behaves normally. Exploit code is publicly available, no CISA KEV entry indicates active exploitation, and the practical risk is bounded by the need for valid credentials, a known or enumerable dataId, and the strict precondition that the parent form has already been permanently deleted - for these reasons the real-world impact sits below the headline 6.0 CVSS 4.0 score.
Authenticated non-admin users can add, modify, or delete global form themes and theme categories in TDuck Survey Form through 6.0 because the FormThemeController write endpoints enforce neither an administrative role nor ownership of the affected theme resources. The flaw is a missing-authorization (CWE-862) issue reachable by any holder of a valid low-privilege account (CVSS 4.0 vector PR:L, AV:N, AC:L, UI:N) with no confidentiality impact - only integrity and availability effects on themes shared across other users' forms. Publicly available exploit code exists (a proof-of-concept script targeting the theme write path), but there is no confirmed active exploitation in the wild; the NVD score of 5.3 is credible and consistent with this limited, credential-gated impact.
Authenticated users of TDuck Survey Form through version 5.3 can hijack forms they do not own and redirect their submissions to arbitrary destinations, because WebhookConfigController enforces neither a form-ownership check nor any validation of the webhook URL. The result is a chained broken-access-control/IDOR plus server-side request forgery issue: a low-privilege account can point a victim's webhook at an external collector to exfiltrate form data, or at internal-only addresses to make the TDuck server issue requests on the attacker's behalf, producing high confidentiality impact with only limited integrity impact. Exploitation needs only a valid authenticated session (remote, no victim interaction beyond normal form submissions, no non-default configuration), and no public exploit code or confirmed active exploitation was identified at time of analysis.
This is a genuine but bounded-priority integrity flaw: in TDuck Survey Form through version 5.0, any authenticated low-privilege user can overwrite other respondents stored form submissions by calling POST /user/form/data/update with a submission identifier that does not belong to them, because the endpoint performs no ownership validation (CWE-639). Confidentiality and availability are unaffected, so the realistic impact is corruption or falsification of collected survey data, including responses containing personal information, rather than data theft or denial of service. Exploitation requires only a valid account (authenticated, PR:L) with no admin role, user interaction, or non-default configuration, and it is aided by submission identifiers being allocated in narrow, guessable ranges; no public exploit code has been identified at time of analysis and the issue is not reported as actively exploited.
Missing authorization in TDuck Survey Form through 5.3 allows any authenticated, low-privileged user to read another form owner's raw settings by calling GET /user/form/setting/{key} with the 8-character form key embedded in a public survey fill link. The endpoint returns the form write password, the owner's notification e-mail address and associated WeChat openIds, which can be chained into form tampering and targeted phishing; a valid account is required (CVSS PR:L, so risk is higher where self-service registration is open), no user interaction is needed, and no public exploit identified at time of analysis. Severity is modest rather than critical because disclosure is confined to per-form settings and the attacker must authenticate first.
Missing server-side enforcement of the write/submission password in TDuck survey form through 6.0 allows remote unauthenticated attackers to post form entries directly to the public submission API, because the password gate is implemented only in front-end JavaScript. An attacker only needs the form key that is exposed in any public share link; no account, no user interaction, and no special configuration are required. Publicly available exploit code exists (a Python PoC targeting the submission endpoint), but there is no indication of confirmed active exploitation (not in CISA KEV), and the impact is bounded to unauthorized submission injection - existing responses cannot be read and availability is unaffected.
Authenticated users who know a form's key can flood TDuck Survey Form through 6.0 with unlimited submissions via POST /user/form/data/create, because that endpoint never enforces the form's publish status, time window, quota, or per-IP limits - letting an attacker falsify or inflate collected survey results. The defect requires only a low-privileged TDuck account (CVSS 3.1 PR:L) plus the target form key, is remotely exploitable over HTTP with no user interaction, and is strictly an integrity issue: no confidential data can be read and no denial of service results. Publicly available exploit code exists (a bypass PoC script for the data-create endpoint), but there is no confirmed active exploitation and no CISA KEV listing; independent assessment rates this a genuine but low-severity authorization defect.
TDuck Survey Form 6.0 fails open in its form-ownership authorization check, letting an authenticated user read submission records that belong to forms which have been permanently deleted. An attacker who knows or can guess a dataId can call GET /user/form/data/details and retrieve the orphaned submission row, including personal information, because FormAuthUtils.hasPermission returns a permissive result when the parent form no longer exists; for live forms the ownership check behaves normally. Exploit code is publicly available, no CISA KEV entry indicates active exploitation, and the practical risk is bounded by the need for valid credentials, a known or enumerable dataId, and the strict precondition that the parent form has already been permanently deleted - for these reasons the real-world impact sits below the headline 6.0 CVSS 4.0 score.
Authenticated non-admin users can add, modify, or delete global form themes and theme categories in TDuck Survey Form through 6.0 because the FormThemeController write endpoints enforce neither an administrative role nor ownership of the affected theme resources. The flaw is a missing-authorization (CWE-862) issue reachable by any holder of a valid low-privilege account (CVSS 4.0 vector PR:L, AV:N, AC:L, UI:N) with no confidentiality impact - only integrity and availability effects on themes shared across other users' forms. Publicly available exploit code exists (a proof-of-concept script targeting the theme write path), but there is no confirmed active exploitation in the wild; the NVD score of 5.3 is credible and consistent with this limited, credential-gated impact.