CVE-2015-4628: SQL injection vulnerability in application/controllers/admin/questiongroups.php in LimeSurvey before 2.06+...

Security readout for executives and security teams

CVE-2015-4628 is an SQL injection issue in LimeSurvey before 2.06+ Build 150618. A logged-in administrator could use the affected question group controller to run unintended database queries through the sid parameter. Business risk depends on whether older LimeSurvey instances are still deployed and who has administrator access. Exposure is likely limited to organizations running LimeSurvey versions older than 2.06+ Build 150618 with reachable administrator functionality. The issue requires authenticated administrator access according to the CVE description, so account compromise or excessive admin privileges materially increase risk. Treat this as a targeted cleanup item for legacy LimeSurvey systems. Prioritize any internet-reachable or business-critical survey deployments, especially where administrator accounts are broadly shared or weakly controlled. No active exploitation evidence is provided in the source bundle. Mitigation focus: Upgrade LimeSurvey to 2.06+ Build 150618 or a later supported release.; Review LimeSurvey's referenced commits, pull request, and bug entry for branch-specific guidance.; Restrict administrative interface access to trusted networks or approved administrators..

Prepared

Jun 13, 2026, 22:39 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.