NgSurvey – Powerful, feature rich self-hosted surveys Security & Risk Analysis

The plugin "ngsurvey" v1.2.2 exhibits a mixed security posture. On the positive side, it demonstrates good practices by consistently using prepared statements for SQL queries and incorporating a reasonable number of capability checks and nonce checks. The absence of known CVEs is also a strong indicator of past diligence. However, significant concerns arise from the static analysis. A substantial portion of the attack surface is unprotected, with 3 out of 4 entry points lacking authentication checks. Furthermore, the taint analysis reveals a high number of flows with unsanitized paths, indicating potential risks for vulnerabilities like cross-site scripting (XSS) or injection attacks, despite the lack of explicitly reported critical or high severity taint issues in the provided data.

The plugin's vulnerability history is clean, with no recorded CVEs. This absence of past vulnerabilities, coupled with the current lack of critical or high severity issues identified in the taint analysis, suggests that the plugin might have been developed with security in mind for certain areas. However, the static analysis findings, particularly the unprotected entry points and the numerous unsanitized taint flows, present a tangible risk that cannot be ignored. The presence of the `unserialize` function is another point of concern, as it can lead to deserialization vulnerabilities if not handled with extreme care and input validation.

In conclusion, while "ngsurvey" v1.2.2 benefits from a clean vulnerability history and secure SQL query practices, it suffers from a large unprotected attack surface and concerning taint analysis results. The unprotected AJAX handlers are a prime target for malicious actors. The high number of unsanitized taint flows, even without explicit critical severity ratings, warrants immediate investigation and remediation. The plugin's overall security can be significantly improved by addressing these identified weaknesses.