A stored cross-site scripting vulnerability in LimeSurvey 7.0.5 allows an authenticated user with administrative permissions to execute arbitrary scripts in the context of other users.

This flaw involves improper neutralization of input within the Survey Menu Entries administration page. An authenticated user with global settings:read permissions can inject malicious payloads into the surveymenu_entries.data field, which are subsequently rendered without proper encoding in an HTML title attribute.

The vulnerability carries a CVSS score of 8.4, reflecting a high potential for impact on integrity and confidentiality. Successful exploitation allows an attacker to manipulate the browser environment of other administrators, potentially leading to unauthorized actions, session hijacking, or the theft of sensitive administrative data. This poses a significant risk to the integrity of survey management systems and the data contained within them.

Immediate Action: Since a specific patch version is currently unknown, administrators should restrict access to the administration panel to only highly trusted personnel and monitor the application for any unauthorized modifications to menu entries.

Proactive Monitoring: Security teams should audit application logs for suspicious entries within the surveymenu_entries.data field and monitor for anomalous script execution patterns in administrative sessions.

Compensating Controls: Implement a strict Content Security Policy (CSP) to mitigate the execution of unauthorized scripts and utilize a Web Application Firewall (WAF) configured to inspect and block common XSS payloads in administrative input fields.

Public Exploit Available: No (exploit_available: false)

Given the high severity score and the potential for administrative account compromise, it is critical to limit the number of users with administrative read access until the vendor provides a formal security update. Organizations should prioritize the implementation of robust input validation and defensive security policies to protect the administrative interface from this injection flaw.