CVE-2025-56421: 
PHP vulnerability analysis and mitigation

CVE-2025-56421 is a SQL Injection vulnerability in LimeSurvey, an open-source online survey application, that allows a remote unauthenticated attacker to extract sensitive information from the backend database. It affects all LimeSurvey versions prior to 6.15.4+250710 (up to and including 6.15.3). The vulnerability was published on March 10, 2026, and carries a CVSS v3.1 base score of 7.5 (High) (Feedly, GitHub Advisory).

The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) and stems from insufficient input validation in LimeSurvey's request handling logic, where user-supplied input is incorporated directly into SQL queries without proper sanitization or parameterization (Feedly, GitHub Advisory). The attack vector is network-based, requires no authentication, no user interaction, and low attack complexity, making it trivially exploitable by any remote attacker. Exploitation patterns consistent with this vulnerability include classic SQL injection (CAPEC-66), blind SQL injection (CAPEC-7), and potentially command-line execution through SQL injection (CAPEC-108) (Feedly).

Successful exploitation allows a remote, unauthenticated attacker to execute arbitrary SQL queries against the LimeSurvey backend database, potentially exposing sensitive data including user credentials, survey responses, and administrative configuration data (GitHub Advisory). The confidentiality impact is rated High, while integrity and availability are unaffected, meaning the primary risk is unauthorized data disclosure rather than data modification or service disruption. In environments where the database user has elevated privileges, there is a theoretical risk of further escalation, such as reading local files or executing OS commands via database features.

No public exploit code or active in-the-wild exploitation has been confirmed for CVE-2025-56421 at this time. The EPSS score is approximately 0.017% (0.000170), indicating a currently low probability of exploitation in the near term (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the unauthenticated, network-accessible nature of the flaw and the widespread deployment of LimeSurvey in academic, government, and enterprise environments make it an attractive target.

1. Reconnaissance: Identify internet-facing LimeSurvey instances running versions prior to 6.15.4+250710 using search engines (e.g., Shodan, Censys) or by checking the LimeSurvey version disclosure in page footers or HTTP headers.
2. Identify injectable parameter: Probe LimeSurvey endpoints and input fields (e.g., survey parameters, URL query strings) for SQL injection vulnerabilities by submitting characters such as single quotes (') or SQL comment sequences (--) and observing error messages or behavioral differences.
3. Craft malicious SQL payload: Construct a SQL injection payload (e.g., ' OR 1=1--, ' UNION SELECT username, password FROM lime_users--) targeting the vulnerable parameter to manipulate query logic.
4. Extract sensitive data: Submit the crafted request to the vulnerable endpoint and retrieve database contents such as user credentials, survey responses, or administrative data from the response or via blind/time-based techniques if output is not directly reflected.
5. Escalate if possible: If the database account has elevated privileges (e.g., FILE privilege in MySQL), attempt to read local files or write web shells for further access (GitHub Advisory).

• Network: Unusual or malformed HTTP requests to LimeSurvey endpoints containing SQL metacharacters (e.g., single quotes, UNION, SELECT, --, OR 1=1) in query parameters or POST body fields.
• Logs: Web server access logs showing repeated requests with SQL injection patterns to LimeSurvey URLs; HTTP 500 errors or database error messages returned to clients, indicating probing activity.
• Logs: Database query logs (if enabled) showing unexpected UNION SELECT, information_schema, or multi-statement queries originating from the LimeSurvey application user.
• File System: Unexpected new files (e.g., web shells) in the LimeSurvey web root directory, particularly if the database account has FILE privileges.
• Process: Unusual child processes spawned by the web server process (e.g., sh, bash, cmd.exe) if OS-level command execution was achieved via the database.

The vendor has released a fix in LimeSurvey version 6.15.4+250710; all users running versions up to and including 6.15.3 should upgrade immediately (GitHub Advisory). As a temporary workaround prior to patching, administrators should restrict public access to LimeSurvey instances where possible, enforce web application firewall (WAF) rules to block SQL injection patterns, and ensure the database account used by LimeSurvey operates with least-privilege permissions (read/write only, no FILE or SUPER privileges). Monitoring database and web server logs for anomalous SQL patterns is also recommended.

The vulnerability was noted by automated CVE tracking services and aggregators including VulDB and Red Hat's CVE database shortly after publication (Feedly). No significant vendor statements beyond the fix release, notable researcher commentary, or major media coverage have been identified for this CVE at this time.