If you Google 'limesurvey viagra p parameter', you'll see a bunch of limesurvey sites with URLs such as:

iai-survey.iai.kit.edu/limesurvey/index.php?p=sales-of-viagra

Such URLs do a 302 redirect, in that case to some online pharmacy

On my own server, I can see the entries in classes/inputfilter/filters are evil, by base64decoding them.

Those entries appear to inject the dodgy URLs; for example, sportpanel.web.t4is.nl/limesurvey/index....omprar-viagra-online

But I haven't worked out what makes that URL redirect to the dodgy site.

No doubt this is a well known exploit; is that enough info to say which one, exactly?

explo1ted wrote: you'll see a bunch of limesurvey sites

About 2,030 results...
and about 9,500 results for the query " v*ag*a limesurvey "

Thank you for reporting this security issue...
BTW there is a lot of surveys indexed by Google (and other major search engines). In my opinion a meta
<meta name="robots" content="none" /> should be added to all shipped templates... It's not a strong protection and only a part of all basic security settings, but it's a good start, useful to limit this kind of infection.

I think you've enough arguments to open a bug-tracker ticket

Hi,

For this one : jQuery JavaScript Library v1.4.2 then an old version in /limesurvey/scripts/jquery/ directory. Then a before 2.00 version .

The first link is a 1.91 version. It looks like the software itself was changed as there is no such "p" parameter in 1.91. It was most likely attacked and modified by one of the other vulnerabilities existing in that old version. Sneaky, requires a change of only a few lines of code.
I would need to get access to the files of such an installation to have more info.

Maybe someone likes to set up a honeypot