CVE-2023-45869

ILIAS 7.25 (2023-09-12) allows any authenticated user to execute arbitrary operating system commands remotely, when a highly privileged account accesses an XSS payload. The injected commands are executed via the exec() function in the execQuoted() method of the ilUtil class (/Services/Utilities/classes/class.ilUtil.php) This allows attackers to inject malicious commands into the system, potentially compromising the integrity, confidentiality, and availability of the ILIAS installation and the underlying operating system.

• CWE-79

• https://rehmeinfosec.de/labor/cve-2023-45869Exploit, Third Party Advisory
• https://rehmeinfosec.de/report/358ad5f6-f712-4f74-a5ee-476efc856cbc/Third Party Advisory
• https://rehmeinfosec.de/labor/cve-2023-45869Exploit, Third Party Advisory
• https://rehmeinfosec.de/report/358ad5f6-f712-4f74-a5ee-476efc856cbc/Third Party Advisory

Published

Oct 26, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-45862An issue was discovered in drivers/usb/storage/ene_ub6250.c …5.5
• CVE-2023-45863An issue was discovered in lib/kobject.c in the Linux kernel…6.4
• CVE-2023-45864A race condition issue discovered in Samsung Mobile Processo…4.7
• CVE-2023-45866Bluetooth HID Hosts in BlueZ may permit an unauthenticated P…6.3
• CVE-2023-45867ILIAS (2013-09-12 release) contains a medium-criticality Dir…6.5
• CVE-2023-45868The Learning Module in ILIAS 7.25 (2023-09-12 release) allow…8.1
• CVE-2023-4587An IDOR vulnerability has been found in ZKTeco ZEM800 produc…5.5
• CVE-2023-45871An issue was discovered in drivers/net/ethernet/intel/igb/ig…7.5
• CVE-2023-45872An issue was discovered in Qt before 6.2.11 and 6.3.x throug…6.5
• CVE-2023-45873An issue was discovered in Couchbase Server through 7.2.2. A…6.5
• CVE-2023-45874An issue was discovered in Couchbase Server through 7.2.2. A…4.3
• CVE-2023-45875An issue was discovered in Couchbase Server 7.2.0. There is …7.5