Description
ILIAS before 7.16 allows External Control of File Name or Path.
Advisories 1
- WID-SEC-2022-2172 ILIAS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 5, 2022
References
- https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-ilias-elearning-platform/
- 20221208 SEC Consult SA-20221206-0 :: Multiple critical vulnerabilities in ILIAS eLearning platform mailing-list
- http://packetstormsecurity.com/files/170181/ILIAS-eLearning-7.15-Command-Injection-XSS-LFI-Open-Redirect.html