Description
ILIAS Learning Management System 4.3 contains a server-side request forgery vulnerability that allows attackers to read local files through portfolio PDF export functionality. Attackers can inject a script that uses XMLHttpRequest to retrieve local file contents when the portfolio is exported to PDF.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| ilias.de | ILIAS Learning Management System | 4.3-5.1 | — |
References
- ExploitDB-49148 exploit
- ILIAS Official Vendor Homepage product
- ILIAS GitHub Repository product
- VulnCheck Advisory: ILIAS Learning Management System 4.3 - SSRF third-party-advisory