Remote Code Execution Vulnerability in ILIAS by ILIAS e-Learning

CVE-2023-45869

What is CVE-2023-45869?

The ILIAS e-Learning platform version 7.25 is affected by a security vulnerability that allows an authenticated user to execute arbitrary operating system commands remotely through a crafted XSS payload. When accessed by a highly privileged account, this vulnerability exploits the exec() function in the execQuoted() method of the ilUtil class. Attackers can leverage this flaw to inject malicious commands into the system, which may lead to potential compromises of the ILIAS installation, along with risks to the integrity, confidentiality, and availability of the underlying operating system.

References