{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/ilias--9.22--10.10--11.3/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ilias:ilias:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-82538"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["ILIAS (\u003c 9.22, \u003c 10.10, \u003c 11.3)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["ILIAS"],"content_html":"\u003cp\u003eILIAS, an open-source learning management system, contains a critical SQL injection vulnerability tracked as CVE-2026-82538. The flaw exists within the repository trash table management functionality. Specifically, the system fails to validate the navigation sort field provided in HTTP requests before incorporating it into the ORDER BY clause of a database query.\u003c/p\u003e\n\u003cp\u003eBecause the application enables multi-statement execution within its database abstraction layer, an attacker with write permissions on any container can leverage the sort parameter to inject stacked queries. Successful exploitation permits an attacker to perform arbitrary read and write operations against the underlying database. These actions can be used to exfiltrate sensitive data or escalate privileges by modifying administrative account credentials, effectively leading to full platform takeover. This vulnerability affects ILIAS versions prior to 9.22, 10.10, and 11.3.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker authenticates to the ILIAS platform with at least write-level permissions on any repository container.\u003c/li\u003e\n\u003cli\u003eAttacker navigates to the repository trash table interface.\u003c/li\u003e\n\u003cli\u003eAttacker intercepts the HTTP request containing the navigation sort parameter.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious payload containing stacked SQL queries, such as modifying administrative user hashes or adding a new administrative user.\u003c/li\u003e\n\u003cli\u003eAttacker injects the payload into the sort parameter of the HTTP request.\u003c/li\u003e\n\u003cli\u003eThe application passes the unsanitized input directly into the SQL ORDER BY clause.\u003c/li\u003e\n\u003cli\u003eThe database driver executes the injected stacked queries alongside the original statement.\u003c/li\u003e\n\u003cli\u003eAttacker gains unauthorized read/write access or elevated privileges resulting in administrator account takeover.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows authenticated attackers to bypass application-level access controls. By gaining full read and write access to the database, attackers can exfiltrate sensitive user data, modify learning content, or escalate their privileges to administrator status, resulting in total compromise of the learning management system.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade ILIAS to version 9.22, 10.10, 11.3, or later immediately to remediate CVE-2026-82538.\u003c/li\u003e\n\u003cli\u003eAudit web server logs for HTTP requests to the repository trash table containing atypical characters such as semicolons, comments, or union/select statements in the sort parameter.\u003c/li\u003e\n\u003cli\u003eRestrict administrative and write permissions to only necessary users to reduce the blast radius of potential exploitation.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-09-04T19:26:48Z","date_published":"2026-09-04T19:26:48Z","id":"https://feed.craftedsignal.io/briefs/2026-09-ilias-sql-injection/","summary":"An authenticated SQL injection vulnerability in ILIAS allows users with write permissions to execute stacked queries, leading to unauthorized database access and potential account takeover.","title":"SQL Injection in ILIAS Repository Trash Table","url":"https://feed.craftedsignal.io/briefs/2026-09-ilias-sql-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - ILIAS (\u003c 9.22, \u003c 10.10, \u003c 11.3)","version":"https://jsonfeed.org/version/1.1"}