Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Thu, 8 Mar 2018 19:41:23 +0100
From: Hanno Böck <>
Subject: Vulnerabilities and default credentials in Ilias e-learning
 software / German gov hack


You may have heard that the German government has been hacked recently.
As we learned today the entry point of the hack likely happened via the
e-learning software Ilias. It's an opensource PHP-based software:

We had an article about this today on and we also created an
English translation:

While we don't know what exactly happened, Ilias itself seems to have
had quite a few vulnerabilties in the past:

Arbitrary copying of files

Cross Site Scripting in SVG import

Cross Site Scripting due to lack of escaping

System emails sometimes get delivered to the wrong people

Vulnerability in handling of media files with unknown impact

Reflected cross site scripting

Appart from all that the software by default creates an administrator
account with the default username "root" and password "homer". The user
is neither forced nor asked to change these.
(Opinions here may differ, but in my opinion default credentials are a
design vulnerability on their own.)

If you happen to run Ilias please update to the latest version and make
sure that you have changed the password for the "root" account.

Hanno Böck

GPG: FE73757FA60E4E21B937579FA5880072BBB51E42

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.