The vulnerability is a SQL injection in the repository trash table sort parameter, allowing authenticated users with write permissions to inject arbitrary SQL into an ORDER BY clause. Because the database layer supports multi‑statement execution, attackers can chain queries to read or modify the entire database and even take over administrator accounts. The weakness is a classic instance of CWE‑89.

The affected product is ILIAS from ILIAS‑eLearning e.V. All releases before 9.22, before 10.10, and before 11.3 are impacted. The exploit targets the repository module that handles trash items, so any deployment of these earlier releases is vulnerable.

With a CVSS score of 8.7 the flaw is considered high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Successful exploitation requires an authenticated user with write access on any container, which is a common privilege in many ILIAS installations. Once the SQL injection is triggered, the attacker can execute arbitrary SQL statements, read or modify database contents, and ultimately gain full administrative control.