LimeSurvey Community Edition 7.8.0 has an SQL injection vulnerability in the survey-archive participant import and SPSS-response export workflow. An authenticated user with global surveys.create permission can craft a .lsa archive that leads to execution of attacker-controlled SQL commands when exporting responses from the imported survey. This occurs because attribute names containing parentheses are treated as SQL expressions rather than quoted identifiers.