ILIAS before 9.24, 10.x before 10.12 and 11.x before 11.5 contains an argument injection vulnerability in assImagemapQuestionGUI that allows question authors to inject ImageMagick convert options via uploaded image filenames. Attackers can embed tab-separated options, which escapeshellcmd() does not neutralise, to write a PHP file under the web root and achieve remote code execution.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
High
Complete denial of service
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products 3
| Configuration | From (including) | Up to (excluding) |
|---|---|---|
|
Ilias Ilias
cpe:2.3:a:ilias:ilias:*:*:*:*:*:*:*:*
|
9.0
|
9.24
|
|
Ilias Ilias
cpe:2.3:a:ilias:ilias:*:*:*:*:*:*:*:*
|
10.0
|
10.12
|
|
Ilias Ilias
cpe:2.3:a:ilias:ilias:*:*:*:*:*:*:*:*
|
11.0
|
11.5
|
References 12
https://docu.ilias.de/ilias.php?baseClass=ilrepositorygui&cmdNode=wy:ll:6t&cmdC…
NVD
https://docu.ilias.de/ilias.php?baseClass=ilrepositorygui&cmdNode=wy:ll:6t&cmdC…
NVD
https://docu.ilias.de/ilias.php?baseClass=ilrepositorygui&cmdNode=wy:ll:6t&cmdC…
NVD
https://github.com/ILIAS-eLearning/ILIAS/commit/ad1423c365a7ffd25bac711d995c643…
Patch Commit
https://github.com/ILIAS-eLearning/ILIAS/blob/v10.11/components/ILIAS/TestQuest…
NVD
https://github.com/ILIAS-eLearning/ILIAS/blob/v10.11/components/ILIAS/TestQuest…
NVD
https://github.com/ILIAS-eLearning/ILIAS/blob/v10.11/components/ILIAS/TestQuest…
NVD
https://github.com/ILIAS-eLearning/ILIAS
NVD
https://www.vulncheck.com/advisories/ilias-before-9.24-10.12-and-11.5-argument-…
VulnCheck Advisory: ILIAS before 9.24, 10.12, and 11.5 Argument Injection via Image Map Question Upload Filename
https://docu.ilias.de/go/blog/15821/950
disclosure@vulncheck.com
https://docu.ilias.de/go/blog/15821/951
disclosure@vulncheck.com
https://docu.ilias.de/go/blog/15821/952
disclosure@vulncheck.com