An issue in the js_localize.php function of LimeSurvey v6.6.2 and before allows attackers to execute arbitrary code via injecting a crafted payload into the lng parameter of the js_localize.php function
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://bugs.limesurvey.org/view.php?id=19639 | Broken Link |
| https://github.com/LimeSurvey/LimeSurvey/blob/6434b12ded1c4b6516200c453441d0896e11eee0/vendor/kcfinder/js_localize.php#L19 | Product |
| https://github.com/sysentr0py/CVEs/tree/main/CVE-2024-42902 | Exploit Third Party Advisory |
Configurations
History
03 Jul 2025, 12:59
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Limesurvey limesurvey
Limesurvey |
|
| CPE | cpe:2.3:a:limesurvey:limesurvey:*:*:*:*:*:*:*:* | |
| References | () https://github.com/LimeSurvey/LimeSurvey/blob/6434b12ded1c4b6516200c453441d0896e11eee0/vendor/kcfinder/js_localize.php#L19 - Product | |
| References | () https://bugs.limesurvey.org/view.php?id=19639 - Broken Link | |
| References | () https://github.com/sysentr0py/CVEs/tree/main/CVE-2024-42902 - Exploit, Third Party Advisory |
03 Sep 2024, 19:40
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-09-03 18:15
Updated : 2025-07-03 12:59
NVD link : CVE-2024-42902
Mitre link : CVE-2024-42902
JSON object : View
Products Affected
limesurvey
- limesurvey
CWE
No CWE.