CVE-2022-43279 SQL injection in n/a
Attackers can execute arbitrary SQL commands via the theme options update view, potentially reading or modifying database contents.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-43279?
CVE-2022-43279 is a high-severity SQL injection vulnerability in Limesurvey Limesurvey, published on 15 Nov 2022. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
LimeSurvey before v5.0.4 was discovered to contain a SQL injection vulnerability via the component /application/views/themeOptions/update.php.
Which versions are affected by CVE-2022-43279?
1 open source package ship an affected version, including limesurvey. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
limesurvey Bitnami | From 5.4.4 | 5.4.5 |
Products include Limesurvey Limesurvey.
How do I fix CVE-2022-43279?
Upgrade limesurvey to 5.4.5 or later.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2022-43279 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-43279 exists.
Other vulnerabilities in Limesurvey Limesurvey
Sources
Also known as BIT-limesurvey-2022-43279, GHSA-f594-4w5v-rpf5.