CVE-2026-12789: SQL Injection in ILIAS Learning Management System 11.0

Technical summary

The vulnerability exists in the ilTrQuery::executeQueries() method within components/ILIAS/Tracking/classes/class.ilTrQuery.php. The Learning Progress Tracking component fails to properly sanitize the troup_table_nav parameter before incorporating it into SQL queries. This improper neutralization of special elements used in an SQL command (CWE-89) and more broadly, improper neutralization of special elements in output (CWE-74) allows authenticated users with administrative rights to inject arbitrary SQL. The attack vector is network-based with low complexity; no user interaction is required once an attacker gains admin credentials.

Business impact

For educational institutions relying on ILIAS, a successful exploitation could lead to unauthorized access to sensitive learning records, student progress data, assessment results, and potentially personal information stored within the LMS database. While the attack requires high-privilege credentials, a compromised administrator account or insider threat could leverage this flaw to exfiltrate or tamper with institutional data. Regulatory compliance issues may arise if student data is accessed without authorization, particularly under FERPA or GDPR frameworks.

Affected systems

ILIAS Learning Management System 11.0 is the confirmed affected version. The vulnerability is localized to the Learning Progress Tracking module. Organizations running earlier or later versions should verify their patch status against the vendor advisory, as the scope of affected versions has not been publicly detailed in the source data provided.

Exploitability

Public exploit code is available, lowering the barrier to attack for anyone with access to an ILIAS administrator account. The CVSS vector (AV:N/AC:L/PR:H) indicates that while the attack is trivially exploitable from the network, it requires high-privilege credentials—typically limited to system administrators or designated LMS operators. The practical risk depends on internal access controls, credential hygiene, and whether admin accounts are adequately protected.

Remediation

The vendor has already identified and internally fixed this issue. Organizations should immediately consult the ILIAS project's official security advisories and release notes to identify the patched version and apply the update. Given the public availability of exploit code, remediation should be prioritized within your patching cycle, particularly for instances accessible from external networks or handling sensitive student data.

Patch guidance

Contact the ILIAS project directly or monitor their official security channels for release notes detailing the fixed version. Apply patches to the Learning Progress Tracking component as soon as they become available. Test patches in a non-production environment first, given the criticality of LMS systems to educational operations. Document the patch version applied for compliance and audit purposes. Verify against the vendor advisory that your version is indeed remediated before considering the issue closed.

Detection guidance

Monitor web server logs and database query logs for unusual SQL syntax patterns in parameters named troup_table_nav, particularly those containing SQL keywords (UNION, SELECT, INSERT, DROP, etc.). Implement database activity monitoring (DAM) tools to flag anomalous queries from the ILIAS application user. Review administrative access logs to identify which users have accessed the Learning Progress Tracking module recently. Security information and event management (SIEM) systems should be configured to alert on failed SQL injection attempts if your application-level logging captures such events.

Why prioritize this

Although the CVSS score of 4.7 is moderate, the combination of public exploit availability, the sensitive nature of student data managed by LMS platforms, and the potential for regulatory violations elevates practical risk. Administrative privilege requirements limit the attacker pool but do not eliminate insider threats. Educational institutions should prioritize this patch to prevent data breaches and maintain compliance.

Risk score, explained

The CVSS 3.1 score of 4.7 reflects a network-accessible vulnerability with low attack complexity but high privilege requirements (PR:H). The impact is limited to confidentiality, integrity, and availability at the component level (S:U means no scope change beyond the affected resource). This medium severity rating appropriately captures that while exploitation is straightforward for admins, the privilege gate and bounded impact scope prevent a higher rating. However, the public exploit code and sensitive data context warrant close monitoring and swift remediation despite the moderate CVSS score.

Frequently asked questions