The vulnerability resides in the RemoteControl API methods invite_participants and remind_participants of LimeSurvey. A caller supplied array of token IDs is concatenated directly into an SQL clause without parameterization or validation. This enables a remote authenticated attacker with tokens/update permission on a survey to inject SQL. Because the PDO connection uses emulated prepared statements and multi-statements are permitted, the attacker can append arbitrary SQL statements, allowing both data exfiltration and destructive writes. The attacker can read any database table accessible to the application user, including administrator password hashes, PII from survey responses, and session data, and can overwrite the administrator password hash to take over the account or delete/modify critical database objects.

Vendors affected: LimeSurvey. Product: LimeSurvey. No specific version or product release information is provided in the CVE data, so all installed instances of LimeSurvey are potentially impacted until a patch is applied.

The CVSS score of 8.7 indicates a high severity vulnerability. The EPSS score is not available, so the current exploitation probability is unknown, but the lack of a KEV listing suggests no known widespread exploitation yet. The likely attack vector is remote, authenticated access with the appropriate permission on a survey and the RemoteControl API enabled (which is not the default). Because the flaw leverages unparameterized SQL and allows stacked queries, a determined attacker can achieve significant data breach and account takeover with modest access to the application. Therefore, the risk remains high for organizations running an exposed RemoteControl interface without additional safeguards.