CVE-2026-12789

ILIAS Learning Management System Learning Progress Tracking class.ilTrQuery.php executeQueries sql injection

View on CVE.org
Published Jun 21, 2026 CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Description
A vulnerability was identified in ILIAS Learning Management System 11.0. This issue affects the function ilTrQuery::executeQueries of the file components/ILIAS/Tracking/classes/class.ilTrQuery.php of the component Learning Progress Tracking. Such manipulation of the argument troup_table_nav leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. It is suggested to upgrade the affected component. This issue was independently identified and fixed internally by the vendor's own security team ahead of this report.

Analysis

AI-generated

Technical impact

The vulnerability is in ILIAS Learning Management System version 11.0 and affects the ilTrQuery::executeQueries function in the Learning Progress Tracking component. By manipulating the troup_table_nav argument, an attacker can inject arbitrary SQL statements into the LMS database, enabling remote exploitation. The attack vector is remote, and the exploit is publicly available. This issue was independently identified and fixed internally by the vendor's own security team ahead of this advisory. The flaw corresponds to CWE‑89 (SQL Injection) and CWE‑74 (Improper Neutralization of Special Elements used in Shell Commands).

Affected Systems

Affected installations are ILIAS Learning Management System version 11.0. The vulnerable executeQueries method is part of the Learning Progress Tracking component, and users of version 11.0 should verify whether their deployment includes this component and are therefore susceptible to the flaw.

Risk and Exploitability

The CVSS score is 5.1, indicating moderate severity. The EPSS score is less than 1%, indicating a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is remote, involving crafted requests to the Tracking module, and no special authentication is required beyond access to the LMS web interface.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply any vendor‑issued patch or update that fixes the SQL injection in ilTrQuery::executeQueries.
  • Deploy a web application firewall or similar filtering solution to block unexpected SQL payloads in request parameters.
  • Monitor access logs for suspicious or malformed requests to the Tracking module and investigate any anomalies promptly.

Generated by OpenCVE AI on July 29, 2026 at 23:39 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Description A vulnerability was identified in ILIAS Learning Management System 11.0. This issue affects the function ilTrQuery::executeQueries of the file components/ILIAS/Tracking/classes/class.ilTrQuery.php of the component Learning Progress Tracking. Such manipulation of the argument troup_table_nav leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. A vulnerability was identified in ILIAS Learning Management System 11.0. This issue affects the function ilTrQuery::executeQueries of the file components/ILIAS/Tracking/classes/class.ilTrQuery.php of the component Learning Progress Tracking. Such manipulation of the argument troup_table_nav leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. It is suggested to upgrade the affected component. This issue was independently identified and fixed internally by the vendor's own security team ahead of this report.
Metrics cvssV2_0

{'score': 5.8, 'vector': 'AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 4.7, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 4.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

 cvssV2_0

{'score': 5.8, 'vector': 'AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 4.7, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 4.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A vulnerability was identified in ILIAS Learning Management System 11.0. This issue affects the function ilTrQuery::executeQueries of the file components/ILIAS/Tracking/classes/class.ilTrQuery.php of the component Learning Progress Tracking. Such manipulation of the argument troup_table_nav leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title ILIAS Learning Management System Learning Progress Tracking class.ilTrQuery.php executeQueries sql injection
First Time appeared Ilias
Ilias learning Management System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:ilias:learning_management_system:*:*:*:*:*:*:*:*
Vendors & Products Ilias
Ilias learning Management System
References
Metrics cvssV2_0

{'score': 5.8, 'vector': 'AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 4.7, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 4.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Jul 15, 2026, 3:22 PM
Reserved
Jun 20, 2026, 10:03 AM

View source JSON

Updated
Jun 22, 2026, 10:55 AM

JSON

Status
Deferred
Published
Jun 21, 2026, 9:16 AM
Modified
Oct 25, 2026, 11:10 PM

View source JSON

No data.

Updated
Jul 29, 2026, 11:45 PM

JSON