An authenticated SQL injection vulnerability in ILIAS allows users with write permissions to perform unauthorized database operations, including administrator account takeover.

The application fails to validate the sort parameter in HTTP requests for the repository trash table, passing it directly into a SQL query. Because the database configuration permits stacked queries, an authenticated attacker with container-level write access can leverage this flaw to gain full read and write control over the database.

This vulnerability carries a CVSS score of 8.8, reflecting its high severity and impact on system integrity and confidentiality. Successful exploitation enables unauthorized actors to access sensitive academic or institutional data and escalate privileges to the administrator level, which could result in complete system compromise and severe reputational damage.

Immediate Action: Upgrade to ILIAS version 9.22, 10.10, 11.3, or later, as provided by the vendor to address the improper input validation.

Proactive Monitoring: Review database access logs for unusual queries originating from the repository trash module and monitor for unexpected administrative account creations or permission changes.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns, specifically targeting ORDER BY clauses and unexpected character sequences in URL parameters.

Public Exploit Available: Yes, a technical write-up detailing the exploit mechanism is available via the VulnCheck advisory referenced in the official CVE data.

Given the potential for full administrator account takeover, administrators must prioritize patching this vulnerability immediately. Organizations unable to update software versions should restrict write permissions for untrusted users to minimize the attack surface until the remediation is fully implemented.