| शीर्षक | ILIAS open source e-Learning e. V. ILIAS >=8.0.0, <=10.1 Unrestricted Upload |
|---|
| विवरण | Unauthenticated remote code execution in ILIAS certificate import
ILIAS suffers from an unauthenticated remote code execution vulnerability in the certificate import feature of certain public object types (Test, Course, Study Programme). Due to insufficient access control, unhandled exceptions during ZIP extraction, and the ability to override server behavior with attacker-supplied .htaccess file, an unauthenticated attacker can upload a crafted certificate template that bypasses protections and achieves arbitrary code execution under /data/. |
|---|
| स्रोत | ⚠️ https://docu.ilias.de/go/blog/15821/882 |
|---|
| उपयोगकर्ता | rehme_srlabs (UID 84282) |
|---|
| सबमिशन | 29/09/2025 09:33 AM (1 वर्ष पहले) |
|---|
| संयम | 06/10/2025 08:15 AM (7 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 327229 [ILIAS तक 8.23/9.13/10.1 Certificate Import अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|