CVE-2019-9960 : What You Need to Know

LimeSurvey up to version 3.16.1+190225 is vulnerable due to the downloadZip feature in the file export.php allowing relative path usage.

Understanding CVE-2019-9960

The vulnerability in LimeSurvey could potentially lead to security risks for users and their data.

What is CVE-2019-9960?

The downloadZip function in LimeSurvey's export.php file permits the use of relative paths, creating a security loophole.

The Impact of CVE-2019-9960

This vulnerability could be exploited by attackers to manipulate file paths and potentially access unauthorized data or execute arbitrary code.

Technical Details of CVE-2019-9960

LimeSurvey's security flaw is detailed below.

Vulnerability Description

The downloadZip function in LimeSurvey's export.php allows the use of relative paths, posing a security risk.

Affected Systems and Versions

Product: LimeSurvey
Vendor: LimeSurvey
Versions affected: up to 3.16.1+190225

Exploitation Mechanism

Attackers can exploit this vulnerability by utilizing relative paths to access sensitive files or execute malicious code.

Mitigation and Prevention

Protect your system from CVE-2019-9960 with the following measures.

Immediate Steps to Take

Update LimeSurvey to the latest version to patch the vulnerability.
Restrict access to the admin folder to authorized personnel only.

Long-Term Security Practices

Regularly monitor and audit file access and permissions.
Implement secure coding practices to prevent similar vulnerabilities.

Patching and Updates

Ensure timely installation of security patches and updates to prevent exploitation of known vulnerabilities.