Ilias Elearning E V
Monthly
SQL injection in ILIAS e-learning platform versions before 9.22, 10.10, and 11.3 allows authenticated users holding write permission on any repository container to achieve full database compromise and administrator account takeover. The repository trash table's sort parameter is passed unsanitized into an ORDER BY clause, and because the ILIAS database layer has multi-statement execution enabled, stacked queries permit arbitrary DML and DDL - not merely data enumeration. Patch versions are available from the vendor; no public exploit code or CISA KEV listing has been identified at time of analysis.
Arbitrary file read in ILIAS's SOAP addFile method permits any authenticated low-privilege user to retrieve server-side files by supplying crafted XML with COPY-mode import entries that contain absolute attacker-controlled paths. The flaw spans three major release lines - all versions before 9.22, 10.0 through 10.9, and 11.0 through 11.2 - and is particularly damaging because the targetable files include ILIAS configuration files storing database credentials and setup passwords, enabling lateral movement to backend systems. No public exploit identified at time of analysis, though the vendor patch commit publicly documents the exact vulnerable code path, substantially reducing the effort required for independent exploit development.
Unauthenticated PHP object injection in the ILIAS e-learning platform allows remote attackers to achieve code execution as the web server user via the Shibboleth back-channel logout endpoint (shib_logout.php). The endpoint runs on an authentication-exempt path and passes every live session row's stored data through a hand-rolled parser that calls unserialize() with no class allowlist, so an attacker who first seeds a serialized object into a session row (via the equally unauthenticated LTI entry point) triggers a destructor-based POP chain that writes attacker-controlled JSON to an attacker-chosen path below the web root. No public exploit has been identified at time of analysis, but the flaw is unauthenticated and network-reachable, and the vendor CVSS 4.0 base score is 9.3 (Critical).
Authorization bypass in ILIAS e-learning platform allows authenticated group members with only read access to modify group map settings and didactic template assignments via crafted POST requests to saveMapSettingsObject() and updateGroupTypeObject() in ilObjGroupGUI, changing group modes and effective permissions for all members. Versions 9.x before 9.23, 10.x before 10.11, and 11.x before 11.4 are confirmed affected per EUVD-2026-72363. No public exploit code has been identified at time of analysis, but the published patch commit reveals the exact missing permission gate, substantially lowering the reconstruction barrier for exploitation.
SQL injection in ILIAS e-learning platform versions before 9.22, 10.10, and 11.3 allows authenticated users holding write permission on any repository container to achieve full database compromise and administrator account takeover. The repository trash table's sort parameter is passed unsanitized into an ORDER BY clause, and because the ILIAS database layer has multi-statement execution enabled, stacked queries permit arbitrary DML and DDL - not merely data enumeration. Patch versions are available from the vendor; no public exploit code or CISA KEV listing has been identified at time of analysis.
Arbitrary file read in ILIAS's SOAP addFile method permits any authenticated low-privilege user to retrieve server-side files by supplying crafted XML with COPY-mode import entries that contain absolute attacker-controlled paths. The flaw spans three major release lines - all versions before 9.22, 10.0 through 10.9, and 11.0 through 11.2 - and is particularly damaging because the targetable files include ILIAS configuration files storing database credentials and setup passwords, enabling lateral movement to backend systems. No public exploit identified at time of analysis, though the vendor patch commit publicly documents the exact vulnerable code path, substantially reducing the effort required for independent exploit development.
Unauthenticated PHP object injection in the ILIAS e-learning platform allows remote attackers to achieve code execution as the web server user via the Shibboleth back-channel logout endpoint (shib_logout.php). The endpoint runs on an authentication-exempt path and passes every live session row's stored data through a hand-rolled parser that calls unserialize() with no class allowlist, so an attacker who first seeds a serialized object into a session row (via the equally unauthenticated LTI entry point) triggers a destructor-based POP chain that writes attacker-controlled JSON to an attacker-chosen path below the web root. No public exploit has been identified at time of analysis, but the flaw is unauthenticated and network-reachable, and the vendor CVSS 4.0 base score is 9.3 (Critical).
Authorization bypass in ILIAS e-learning platform allows authenticated group members with only read access to modify group map settings and didactic template assignments via crafted POST requests to saveMapSettingsObject() and updateGroupTypeObject() in ilObjGroupGUI, changing group modes and effective permissions for all members. Versions 9.x before 9.23, 10.x before 10.11, and 11.x before 11.4 are confirmed affected per EUVD-2026-72363. No public exploit code has been identified at time of analysis, but the published patch commit reveals the exact missing permission gate, substantially lowering the reconstruction barrier for exploitation.