SQL injection vulnerability in repository.php in ILIAS 3.7.4 and earlier allows remote attackers to execute arbitrary SQL commands via the ref_id parameter.
https://www.exploit-db.com/exploits/7570
https://exchange.xforce.ibmcloud.com/vulnerabilities/47615
https://euvd.enisa.europa.eu/vulnerability/EUVD-2008-5786