CVE-2024-6933 is a medium severity (CVSS 6.3) SQL injection in LimeSurvey 6.5.14, in the survey general settings handler. A logged-in user can supply a crafted language value. The record says upgrading to 6.6.2+240827 or later resolves it.
What's affected
The NVD record names LimeSurvey 6.5.14-240624 and describes the vulnerable function as actionUpdateSurveyLocaleSettingsGeneralSettings in the Survey General Settings Handler. The record states that upgrading to version 6.6.2+240827 resolves the issue, and points to patch commit d656d2c7980b7642560977f4780e64533a68e13d.
I could confirm the commit in the LimeSurvey repository. Its title is "Fixed issue #19717: SQL injection vulnerability when save survey". It changes one file, application/helpers/common_helper.php, with 7 lines added and 2 removed. In the language helper, the base language value is now passed through the project's own language code sanitiser before it is used. A second function that fixes language consistency gets the same treatment.
The record does not say which earlier 6.5.x versions are affected, only that 6.5.14-240624 was reported. Treat any release before 6.6.2+240827 as in scope until the project says otherwise.
The scoring is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. Low privileges are required, which is why this is medium and not high. The listed weaknesses are CWE-89 and CWE-74, injection in general. I found no second severity figure from the project.
How to check if you're exposed
- Sign in to the LimeSurvey admin area and read the version shown in the footer or on the about page.
- On the server, check the version file in the installation. The version appears in the application config folder, in version.php.
- Compare it with 6.6.2+240827. Anything earlier needs an upgrade.
- List who holds accounts that can edit survey settings. The flaw needs an authenticated user, so the number of such accounts is your practical exposure.
What to do now
- Back up the database and the upload folder.
- Upgrade LimeSurvey to 6.6.2+240827 or later, following the project's upgrade guide on its download page.
- Review accounts with permission to edit survey settings, and remove those that are no longer needed.
- Check the survey data for unexpected changes, and the web server logs for odd requests to the survey locale settings route.
- If you run a hosted service from the project, check whether it is already on a fixed release.
Why it matters
LimeSurvey stores respondent answers, and surveys often hold personal or sensitive information. An injection flaw in an admin feature is less dramatic than one open to the internet, but accounts for survey authors are often given to many people, including contractors and students.
The cause is a value, the language code, that was trusted because it normally comes from a drop-down list. The commit shows the usual fix: treat every value the client sends as untrusted, even when the user interface only offers a fixed set. That applies to your own code as well.
CISA does not list this CVE as known exploited, and the sources here do not report exploitation in the wild. The original report is a public write up by an outside researcher, and the record says the exploit has been published.
Quick check
Does an attacker need an account?
Yes. The vector requires low privileges, so the user must be able to reach the survey settings.
Where is the fix?
In LimeSurvey 6.6.2+240827 and later, and in commit d656d2c on the project's GitHub repository.
Sources
Last reviewed: 19 October 2026.
