Executive brief
ILIAS is an open-source e-learning platform used to manage and deliver online courses and educational content. A SQL injection vulnerability in the repository trash feature allows authenticated users with write permissions to inject arbitrary SQL commands through a sorting parameter, potentially enabling full database access, data theft, or administrator account takeover.
Technical details
The vulnerability is a SQL injection flaw in the repository trash table navigation, where the sort field from HTTP requests is concatenated directly into the ORDER BY clause of a SQL query without validation against a whitelist of permitted columns. An authenticated attacker with write permission on any container can craft a malicious sort parameter containing SQL injection payloads. Because the database layer has multi-statement execution enabled, stacked queries allow an attacker to perform arbitrary database read and write operations, including creation of new administrator accounts or modification of existing ones. Patched versions include ILIAS 9.22, 10.10, and 11.3 or later.
Affected products
- ILIAS ILIAS before 9.22, 10.10, and 11.3
Timeline
- 2026-09-04: disclosed