RCE in LimeSurvey via plugin upload

LimeSurvey is a PHP survey manager. Like many CMSs, it lets you extend functionality by installing plugins from the admin panel, and there's the classic abuse: a plugin is a .zip of PHP code that the server unzips and makes reachable, so uploading a malicious plugin is the same as uploading a webshell.

A LimeSurvey plugin needs a config.xml with its metadata (name, version, compatibility) and the plugin files. To sneak in a shell you package the config.xml alongside a revshell.php:

zip plugin.zip config.xml revshell.php

You upload it under Configuration → Plugins → Upload & install, and once installed the .php becomes reachable under the plugin's uploads directory (something like /upload/plugins/<name>/revshell.php). Requesting it with a browser or curl runs it and returns the shell, usually as www-data.

The requirement is admin access to the panel; in practice that access usually comes from reused or leaked credentials. Specific versions have their own CVEs, but the pattern "admin can install plugins = admin can run code" is common to almost all of them.

How to detect it. The signature is an authenticated plugin upload (POST to the plugin-install endpoint) followed by a new .php appearing in /upload/plugins/<name>/ (FIM) and a direct request to that file; no legitimate install leaves a reachable revshell.php. Host-side confirmation is the web process (www-data) spawning sh/bash as a child when that .php is requested (auditd/Sysmon for Linux). An admin login from an external IP shortly before is the preceding sign.

Defence. Restrict who can install plugins, validate and sign the packages, isolate the uploads directory (no PHP execution), and keep LimeSurvey updated. Above all, don't expose the admin panel or reuse passwords across services.