CVE-2026-12789: ILIAS Learning Management System SQLi

CVE-2026-12789 Overview

CVE-2026-12789 is a SQL injection vulnerability in ILIAS Learning Management System 11.0. The flaw resides in the ilTrQuery::executeQueries function within components/ILIAS/Tracking/classes/class.ilTrQuery.php, part of the Learning Progress Tracking component. Attackers can manipulate the troup_table_nav argument to inject arbitrary SQL statements. The attack is exploitable over the network and requires high privileges. A public exploit is available, increasing the risk of opportunistic attacks. The vendor was contacted before public disclosure but did not respond, leaving the issue unpatched at publication time.

Critical Impact
Authenticated remote attackers can inject SQL through the Learning Progress Tracking component to read or alter learning management data.

Affected Products

ILIAS Learning Management System 11.0
Component: Learning Progress Tracking
File: components/ILIAS/Tracking/classes/class.ilTrQuery.php

Discovery Timeline

2026-06-21 - CVE-2026-12789 published to NVD
2026-06-22 - Last updated in NVD database

Technical Details for CVE-2026-12789

Vulnerability Analysis

The vulnerability is classified under [CWE-74] (Improper Neutralization of Special Elements in Output). The flaw exists in the ilTrQuery::executeQueries function, which processes the troup_table_nav parameter without proper sanitization or parameterized queries. Attackers supply crafted input to this parameter, and the application concatenates it directly into a SQL statement executed against the backend database.

Exploitation requires authenticated access with high privileges, which limits the attacker population. However, the network attack vector and the availability of a public proof-of-concept lower the barrier for adversaries who already hold valid credentials. Successful injection can disclose tracked learner data, alter progress records, or pivot to broader database access depending on the database user's permissions.

Root Cause

The ilTrQuery::executeQueries function fails to neutralize user-controlled input passed via troup_table_nav before incorporating it into SQL queries. Input validation and prepared statements are absent on this code path within the Learning Progress Tracking component.

Attack Vector

An authenticated attacker sends an HTTP request containing a crafted troup_table_nav parameter to the Learning Progress Tracking endpoint. The injected SQL fragment is concatenated into the query string executed by ilTrQuery::executeQueries. The attacker can extract, modify, or delete data accessible to the application's database account.

The vulnerability mechanism is described in the VulDB advisory for CVE-2026-12789 and the corresponding VulDB vulnerability record #372531. No verified proof-of-concept code is reproduced here.

Detection Methods for CVE-2026-12789

Indicators of Compromise

HTTP requests containing SQL metacharacters such as single quotes, UNION, SELECT, or comment sequences in the troup_table_nav parameter.
Unexpected database errors logged by ILIAS when accessing Learning Progress Tracking pages.
Anomalous queries originating from the ILIAS application user against tracking-related tables.

Detection Strategies

Inspect web server access logs for requests to Learning Progress Tracking endpoints with suspicious troup_table_nav values.
Deploy web application firewall (WAF) signatures that flag SQL keywords and tautologies in query parameters.
Enable database query logging and review for unusual statements referencing tracking tables outside normal application patterns.

Monitoring Recommendations

Monitor authenticated sessions for privileged accounts performing unexpected access to tracking modules.
Alert on database errors correlated with HTTP 500 responses on ILIAS endpoints.
Track outbound data volume from the ILIAS server to identify potential data exfiltration following injection attempts.

How to Mitigate CVE-2026-12789

Immediate Actions Required

Restrict access to ILIAS administrative and high-privilege accounts, since exploitation requires authenticated high-privilege access.
Place the ILIAS instance behind a WAF configured to block SQL injection patterns targeting the troup_table_nav parameter.
Audit existing high-privilege accounts and rotate credentials suspected of compromise.

Patch Information

No vendor patch is available at the time of publication. The vendor did not respond to disclosure attempts according to the VulDB record. Monitor the ILIAS project channels for future security releases addressing the Learning Progress Tracking component.

Workarounds

Disable or restrict access to the Learning Progress Tracking component until a patch is released.
Apply database-level least privilege so the ILIAS application account cannot read or modify data outside its required scope.
Implement input filtering at a reverse proxy to reject troup_table_nav values containing SQL metacharacters.

bash

# Example WAF rule (ModSecurity) blocking SQL metacharacters in troup_table_nav
SecRule ARGS:troup_table_nav "@rx (?i)(union|select|insert|update|delete|drop|--|;|')" \
    "id:1026789,phase:2,deny,status:403,msg:'Potential SQLi targeting CVE-2026-12789'"