ILIAS versions before 9.24, 10.12, and 11.5 contain a PHP object injection vulnerability allowing authenticated users with Test creation or import permissions to execute arbitrary code by deserializing crafted Test archives. The vulnerability arises from unsafe unserialize() calls on a malicious tst_sequence attribute, enabling abuse of Guzzle or Monolog gadget chains to write PHP files and execute code remotely. The CVSS 4.0 score is 8.7, indicating high severity.
ILIAS versions before 9.24, 10.12, and 11.5 have an unrestricted file upload vulnerability in the QTI question import image handling component. Authenticated users with question pool import rights can upload crafted archives that write executable files, including .htaccess and PHP files, to web-accessible directories. This allows remote code execution as the web server user.
ILIAS versions before 9.24, 10.x before 10.12, and 11.x before 11.5 contain an argument injection vulnerability in the assImagemapQuestionGUI component. This flaw allows question authors to inject ImageMagick convert options via uploaded image filenames. By embedding tab-separated options that bypass escapeshellcmd(), an attacker can write a PHP file under the web root, leading to remote code execution.
ILIAS versions before 9.23, 10.11, and 11.4 contain an authorization bypass vulnerability in ilObjGroupGUI where saveMapSettingsObject() and updateGroupTypeObject() perform state-changing operations without write permission checks. Authenticated users with only read access to a group can craft POST requests to modify group map settings and didactic template assignments, changing group modes and permissions for all members.
ILIAS before versions 9.22, 10.10, and 11.3 contains a SQL injection vulnerability in the repository trash table where the table navigation sort field from HTTP requests is passed directly into the ORDER BY clause of a SQL query without validation against declared sortable columns. Authenticated users with write permission on any container can inject arbitrary SQL through the sort parameter, and because multi-statement execution is enabled in the database layer, stacked queries enable full database read and write access as well as administrator account takeover.
ILIAS before versions 9.22, 10.10, and 11.3 contains an arbitrary file read vulnerability in the SOAP addFile method that allows authenticated users to read server files by supplying crafted XML with COPY-mode imports. Attackers can construct absolute file paths through an unsandboxed import directory and retrieve sensitive files including configuration files containing database credentials and setup passwords.
ILIAS before versions 9.22, 10.10, and 11.3 contains an unauthenticated PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting serialized objects through the LTI authentication endpoint and triggering deserialization via the Shibboleth back-channel logout endpoint. Attackers can write arbitrary serialized objects into session storage, then exploit an available POP gadget through the logout endpoint's unrestricted deserialization to write attacker-controlled PHP content to a web-accessible path and achieve remote code execution as the web server user.