Description (CNA)
ILIAS 7.25 (2023-09-12) allows any authenticated user to execute arbitrary operating system commands remotely, when a highly privileged account accesses an XSS payload. The injected commands are executed via the exec() function in the execQuoted() method of the ilUtil class (/Services/Utilities/classes/class.ilUtil.php) This allows attackers to inject malicious commands into the system, potentially compromising the integrity, confidentiality, and availability of the ILIAS installation and the underlying operating system.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| n/a / n/a | affected n/a |
CWE
No CWE identifiers supplied.
References
- https://rehmeinfosec.de/report/358ad5f6-f712-4f74-a5ee-476efc856cbc/
- https://rehmeinfosec.de/labor/cve-2023-45869
ADP enrichment
No English description supplied.
No English description supplied.
No references supplied.