ILIAS (< 9.22, < 10.10, < 11.3) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/ilias--9.22--10.10--11.3/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 04 Sep 2026 19:26:48 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgSQL Injection in ILIAS Repository Trash Tablehttps://feed.craftedsignal.io/briefs/2026-09-ilias-sql-injection/Fri, 04 Sep 2026 19:26:48 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-ilias-sql-injection/An authenticated SQL injection vulnerability in ILIAS allows users with write permissions to execute stacked queries, leading to unauthorized database access and potential account takeover.ILIAS, an open-source learning management system, contains a critical SQL injection vulnerability tracked as CVE-2026-82538. The flaw exists within the repository trash table management functionality. Specifically, the system fails to validate the navigation sort field provided in HTTP requests before incorporating it into the ORDER BY clause of a database query.

Because the application enables multi-statement execution within its database abstraction layer, an attacker with write permissions on any container can leverage the sort parameter to inject stacked queries. Successful exploitation permits an attacker to perform arbitrary read and write operations against the underlying database. These actions can be used to exfiltrate sensitive data or escalate privileges by modifying administrative account credentials, effectively leading to full platform takeover. This vulnerability affects ILIAS versions prior to 9.22, 10.10, and 11.3.

Attack Chain

  1. Attacker authenticates to the ILIAS platform with at least write-level permissions on any repository container.
  2. Attacker navigates to the repository trash table interface.
  3. Attacker intercepts the HTTP request containing the navigation sort parameter.
  4. Attacker crafts a malicious payload containing stacked SQL queries, such as modifying administrative user hashes or adding a new administrative user.
  5. Attacker injects the payload into the sort parameter of the HTTP request.
  6. The application passes the unsanitized input directly into the SQL ORDER BY clause.
  7. The database driver executes the injected stacked queries alongside the original statement.
  8. Attacker gains unauthorized read/write access or elevated privileges resulting in administrator account takeover.

Impact

Successful exploitation allows authenticated attackers to bypass application-level access controls. By gaining full read and write access to the database, attackers can exfiltrate sensitive user data, modify learning content, or escalate their privileges to administrator status, resulting in total compromise of the learning management system.

Recommendation

  1. Upgrade ILIAS to version 9.22, 10.10, 11.3, or later immediately to remediate CVE-2026-82538.
  2. Audit web server logs for HTTP requests to the repository trash table containing atypical characters such as semicolons, comments, or union/select statements in the sort parameter.
  3. Restrict administrative and write permissions to only necessary users to reduce the blast radius of potential exploitation.
]]>highadvisory