Description

ILIAS before versions 9.22, 10.10, and 11.3 contains a SQL injection vulnerability in the repository trash table where the table navigation sort field from HTTP requests is passed directly into the ORDER BY clause of a SQL query without validation against declared sortable columns. Authenticated users with write permission on any container can inject arbitrary SQL through the sort parameter, and because multi-statement execution is enabled in the database layer, stacked queries enable full database read and write access as well as administrator account takeover.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-04T18:18:01.357Z",
  "pubdate": "2026-09-04T18:18:01.357Z",
  "executiveSummary": "A critical SQL injection vulnerability exists in ILIAS versions prior to 9.22, 10.10, and 11.3, residing specifically within the repository trash table management functionality. The flaw is rooted in the unsafe handling of the 'sort' parameter during HTTP requests, which is concatenated directly into SQL ORDER BY clauses without proper sanitization or validation against a whitelist of acceptable column identifiers.\nThis vulnerability grants authenticated users possessing write permissions on any container the ability to execute arbitrary SQL commands. Because the application's database configuration permits stacked queries, an attacker can bypass standard query constraints to perform unauthorized data extraction, modification, or deletion. Furthermore, the capacity for multi-statement execution facilitates full system compromise, including the potential for total database control and administrator account takeover. Given the severity of the impact, immediate remediation is required for all affected ILIAS deployments to prevent exploitation by malicious actors who have obtained low-privileged access to the system.",
  "technicalDetails": "The vulnerability stems from improper input validation within the repository trash table's sort functionality. Specifically, user-supplied input provided via the 'sort' HTTP parameter is passed directly into the SQL query construction process without being validated against a defined list of allowed sortable columns or being subjected to parameterized query techniques. This allows an attacker to inject arbitrary SQL syntax into the ORDER BY clause of the underlying query.\nThe exploitation flow begins with an authenticated user, who must hold at least write permissions on any container within the ILIAS instance, submitting a crafted HTTP request. By manipulating the 'sort' parameter, the attacker can break out of the intended query context. Since the ILIAS database layer is configured to support stacked queries—enabling the execution of multiple semicolon-delimited SQL statements in a single database call—the attacker can append malicious SQL commands to the original query. This turns a simple sorting operation into a powerful injection vector.\nStep-by-step exploitation typically follows this progression: 1) The attacker intercepts a request to the repository trash management module. 2) The attacker modifies the 'sort' parameter to include a crafted payload. 3) The payload injects a closing quote or keyword followed by a semicolon to terminate the legitimate query. 4) The payload introduces a new, malicious command, such as 'UPDATE' or 'INSERT', to manipulate user privileges or extract sensitive data from the database. 5) The database executes the injected commands, granting the attacker elevated privileges or access to administrative accounts.\nThe impact is comprehensive due to the database layer's support for multi-statement execution. An attacker can not only read data stored in the database but can also modify administrative records, inject new administrator accounts, or alter global application configurations. This level of access effectively circumvents the application's security model, leading to full compromise of the ILIAS installation. The vulnerability affects ILIAS versions prior to 9.22, 10.10, and 11.3. Remediation requires patching the application to implement strict whitelisting of the sort field input and ensuring that no dynamic user input is concatenated into query strings."
}