Tduck Survey Form
Monthly
Authenticated users of TDuck Survey Form through version 5.3 can hijack forms they do not own and redirect their submissions to arbitrary destinations, because WebhookConfigController enforces neither a form-ownership check nor any validation of the webhook URL. The result is a chained broken-access-control/IDOR plus server-side request forgery issue: a low-privilege account can point a victim's webhook at an external collector to exfiltrate form data, or at internal-only addresses to make the TDuck server issue requests on the attacker's behalf, producing high confidentiality impact with only limited integrity impact. Exploitation needs only a valid authenticated session (remote, no victim interaction beyond normal form submissions, no non-default configuration), and no public exploit code or confirmed active exploitation was identified at time of analysis.
This is a genuine but bounded-priority integrity flaw: in TDuck Survey Form through version 5.0, any authenticated low-privilege user can overwrite other respondents stored form submissions by calling POST /user/form/data/update with a submission identifier that does not belong to them, because the endpoint performs no ownership validation (CWE-639). Confidentiality and availability are unaffected, so the realistic impact is corruption or falsification of collected survey data, including responses containing personal information, rather than data theft or denial of service. Exploitation requires only a valid account (authenticated, PR:L) with no admin role, user interaction, or non-default configuration, and it is aided by submission identifiers being allocated in narrow, guessable ranges; no public exploit code has been identified at time of analysis and the issue is not reported as actively exploited.
Authenticated users of TDuck Survey Form through version 5.3 can hijack forms they do not own and redirect their submissions to arbitrary destinations, because WebhookConfigController enforces neither a form-ownership check nor any validation of the webhook URL. The result is a chained broken-access-control/IDOR plus server-side request forgery issue: a low-privilege account can point a victim's webhook at an external collector to exfiltrate form data, or at internal-only addresses to make the TDuck server issue requests on the attacker's behalf, producing high confidentiality impact with only limited integrity impact. Exploitation needs only a valid authenticated session (remote, no victim interaction beyond normal form submissions, no non-default configuration), and no public exploit code or confirmed active exploitation was identified at time of analysis.
This is a genuine but bounded-priority integrity flaw: in TDuck Survey Form through version 5.0, any authenticated low-privilege user can overwrite other respondents stored form submissions by calling POST /user/form/data/update with a submission identifier that does not belong to them, because the endpoint performs no ownership validation (CWE-639). Confidentiality and availability are unaffected, so the realistic impact is corruption or falsification of collected survey data, including responses containing personal information, rather than data theft or denial of service. Exploitation requires only a valid account (authenticated, PR:L) with no admin role, user interaction, or non-default configuration, and it is aided by submission identifiers being allocated in narrow, guessable ranges; no public exploit code has been identified at time of analysis and the issue is not reported as actively exploited.