Exploitation Summary
EIP tracks 1 public exploit for CVE-2025-34120.
PoCs published by Pichaya Morimoto, Christian Mehlmauer, including Metasploit module auxiliary/admin/http/limesurvey_file_download.
AI-analyzed exploit summary This Metasploit module exploits an unauthenticated file download vulnerability in LimeSurvey by leveraging a deserialization flaw to traverse directories and download arbitrary files as a ZIP archive. The exploit constructs a serialized payload to manipulate file paths and retrieves the file via HTTP.
Description
An unauthenticated file download vulnerability exists in LimeSurvey versions from 2.0+ up to and including 2.06+ Build 151014. The application fails to validate serialized input to the admin backup endpoint (`index.php/admin/update/sa/backup`), allowing attackers to specify arbitrary file paths using a crafted `datasupdateinfo` payload. The files are packaged in a ZIP archive and made available for download without authentication. This vulnerability can be exploited to read arbitrary files on the host system, including sensitive OS and configuration files.
Exploits (1)
This Metasploit module exploits an unauthenticated file download vulnerability in LimeSurvey by leveraging a deserialization flaw to traverse directories and download arbitrary files as a ZIP archive. The exploit constructs a serialized payload to manipulate file paths and retrieves the file via HTTP.
References (5)
Scores
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N