CoreCVE
Back

CRITICAL

ILIAS 7.25 (2023-09-12) allows any authenticated user to execute arbitrary operating system commands remotely, when a highly privileged account accesses an XSS payload

Published Oct 26, 2023

Description

ILIAS 7.25 (2023-09-12) allows any authenticated user to execute arbitrary operating system commands remotely, when a highly privileged account accesses an XSS payload. The injected commands are executed via the exec() function in the execQuoted() method of the ilUtil class (/Services/Utilities/classes/class.ilUtil.php) This allows attackers to inject malicious commands into the system, potentially compromising the integrity, confidentiality, and availability of the ILIAS installation and the underlying operating system.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (3)

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED
Assigner mitre
Published Oct 26, 2023
Updated Sep 12, 2024
Reserved Oct 14, 2023
Link CVE-2023-45869

CISA Vulnrichment

Updated Sep 10, 2024

NVD

Status Modified
Modified Jun 17, 2026
Link CVE-2023-45869

Red Hat

No data

ENISA EUVD

Assigner mitre
Published Oct 26, 2023
Updated Sep 12, 2024
Link EUVD-2023-50135

GitHub

No data