CVE-2026-50636: LimeSurvey RemoteControl API SQL Injection (CVSS 8.8)

Technical summary

The vulnerability exists in the RemoteControl API's invite_participants and remind_participants methods, which accept a caller-supplied array of token IDs. These values are passed directly to TokenDynamic::findUninvited() without parameterization or validation, where they are concatenated into a WHERE token IN (...) clause. LimeSurvey's PDO configuration uses emulated prepared statements (emulatePrepare = true) and does not disable MySQL multi-statement execution. An attacker can inject SQL metacharacters and statement terminators to break the query syntax, allowing injection of additional SELECT, INSERT, UPDATE, DELETE, DROP, or CREATE statements in the same request. Data extraction is possible via time-based blind SQL injection using SLEEP() functions to infer database contents. Full write access to the database—limited only by the application's database user privileges—enables data modification, table destruction, and direct administrator credential compromise.

Business impact

Successful exploitation allows complete compromise of LimeSurvey instance confidentiality, integrity, and availability. An attacker can exfiltrate all survey data, user credentials, and administrative settings; directly modify or delete survey responses and user records; seize administrative accounts; or render the application inoperable by dropping core tables. For organizations using LimeSurvey to collect sensitive information (HR surveys, customer feedback, research data), the exposure is severe. Compliance implications depend on data sensitivity and regulatory obligations (GDPR, HIPAA, etc.). Incident response would require forensic investigation of database logs and potential notification obligations to data subjects.

Affected systems

LimeSurvey installations with RemoteControl API enabled are affected. The RemoteControl interface is not enabled by default, so risk is limited to deployments that have explicitly activated it (RPCInterface = json/xml configuration). All affected versions prior to a patched release are susceptible if this configuration is present. Check your LimeSurvey admin panel under Global Settings > Security for 'Enable RemoteControl API' status.

Exploitability

Exploitation requires two conditions: (1) RemoteControl API must be enabled (non-default), and (2) the attacker must hold valid API credentials or session access with the tokens/update permission. No special network positioning or user interaction is required beyond initial authentication. Once authenticated, the injection is trivial to execute via JSON or XML API calls; no complex evasion is needed. The SQL injection itself is straightforward due to lack of input validation. However, data exfiltration via blind injection is time-consuming and may trigger database slow-query logging. Overall exploitability is high among organizations running RemoteControl; risk is low for default deployments without it.

Remediation

Apply the vendor's patched release when available (verify the specific version number against the LimeSurvey advisory). The patch should parameterize token ID inputs using prepared statement placeholders rather than string concatenation. As a temporary mitigation for unpatched systems, disable the RemoteControl API (set RPCInterface = false in the configuration) if not actively in use. Restrict API access via firewall rules or reverse-proxy authentication to trusted client IP ranges. Audit database user privileges to ensure the LimeSurvey application account has the minimum necessary permissions. Monitor database logs for multi-statement queries or unusual INSERT/UPDATE/DELETE patterns.

Patch guidance

Wait for official LimeSurvey release notes and security advisory that specify the patched version number. Apply patches to all affected instances immediately upon availability. Test in a non-production environment first to ensure compatibility with your configuration and custom extensions. After patching, verify RemoteControl API functionality if your deployment relies on it, and confirm that API calls still work as expected. Review any custom integrations or scripts that invoke the RemoteControl interface.

Detection guidance

Monitor database query logs for: (1) SQL queries containing UNION, SELECT within WHERE clauses, SLEEP(), BENCHMARK(), or other injection signatures in the token ID context; (2) multi-statement execution or statement terminators (semicolons) in API request payloads; (3) unauthorized INSERT, UPDATE, DELETE, DROP, or CREATE statements issued by the application database user. Monitor application logs for RemoteControl API calls with unusual or malformed token array parameters. Set up alerts on failed authentication attempts against the API endpoint. Database performance anomalies (long-running queries) during API calls may indicate blind injection attempts.

Why prioritize this

CVSS 8.8 (HIGH) reflects the severity of unauthenticated read and write access to the entire database. However, the requirement for RemoteControl enablement and prior authentication reduces real-world risk for many deployments. Prioritize patching if: (1) RemoteControl is enabled and exposed to untrusted networks; (2) your LimeSurvey instance handles sensitive survey data (PII, financial, health); (3) the instance is internet-facing. If RemoteControl is disabled or behind strong network controls, risk is manageable short-term while awaiting patches.

Risk score, explained

The CVSS 3.1 score of 8.8 captures complete database compromise (Confidentiality: High, Integrity: High, Availability: High) with no user interaction required and low attack complexity. The score reflects that an authenticated attacker can read and modify any data without special privileges. The score is appropriate but should be contextualized: risk is substantially lower in default LimeSurvey installations (RemoteControl disabled) and higher in organizations that rely on RemoteControl for third-party integrations.

Frequently asked questions