DWSurvey 6.14.0 is susceptible to an unauthorized data deletion vulnerability that poses a significant risk to the integrity of survey data and system availability.

The application fails to perform adequate access control checks when processing deletion requests, allowing an unauthenticated attacker to supply a target questionnaire ID and trigger its removal.

The ability for an unauthenticated user to delete arbitrary questionnaires can lead to severe data loss and the disruption of critical business processes. With a CVSS score of 7.5, this high severity flaw highlights the potential for significant operational impact, as unauthorized parties can manipulate or destroy sensitive survey data without requiring any level of privilege.

Immediate Action: Restrict network access to the DWSurvey instance and monitor for unauthorized deletion requests until an official vendor patch is released.

Proactive Monitoring: Review web server and application logs for suspicious HTTP requests involving questionnaire deletion endpoints, specifically looking for repeated attempts with varying ID parameters.

Compensating Controls: Implement Web Application Firewall (WAF) rules to inspect and validate request parameters for deletion functions, blocking traffic that does not originate from authorized administrative sessions.

Public Exploit Available: Yes, a proof-of-concept is documented in the researcher write-up referenced in the CVE record.

This vulnerability presents a clear risk to data integrity due to the lack of authorization checks on sensitive administrative functions. Organizations using DWSurvey 6.14.0 must treat this as a high priority item, implementing strict network-level access controls immediately while awaiting a formal patch from the vendor.