EUVD-2026-50125
GHSA-7j7j-vvxx-737q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend malicious SQL payload to SCORM report endpoint
-
ExploitTrigger SQL injection in unsanitized input
-
ExecutionExtract database contents including credentials and tokens
-
ImpactUse credentials/JWT tokens to hijack user accounts
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The SCORM report endpoint must be reachable over the network; the vulnerability is exploitable without authentication, so no user interaction or prior access is needed. No specific configuration is required beyond the default deployment that exposes the endpoint-no feature enablement or non-default settings are mentioned. |
| Impact | The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) indicates a network-exploitable, low-complexity attack with no privileges or user interaction, leading to high confidentiality and integrity impacts but no availability impact. No EPSS score is available, so the probability of exploitation cannot be quantified; no KEV listing means active exploitation is not confirmed. No POC code has been reported. Using SSVC, the vulnerability is in the “exploitation: none” state given absence of known exploitation, but the high technical impact and automatable nature (SQL injection) increase urgency. However, the real-world risk depends heavily on the exposure of the SCORM report endpoint; if restricted to internal networks or disabled, risk is significantly lower. Despite the high CVSS, the lack of evidence of exploitation and unknown patch availability may moderate immediate priority compared to actively exploited flaws. |
| Exploit ScenarioDerived | An attacker sends a crafted HTTP request to the publicly accessible SCORM report endpoint of a Koollab LMS instance, injecting SQL syntax that triggers database errors revealing schema information. After mapping the database structure, the attacker uses error-based extraction to dump tables containing user passwords and JWT secrets. With the obtained credentials or tokens, they hijack administrator sessions and take full control of the LMS and its user data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 29, 2026
Error-based SQL injection in Koollab LMS allows unauthenticated attackers to exfiltrate sensitive database contents, including user credentials and JWT tokens that may enable account takeover. The vulnerability, reported through Singapore’s CSA, affects the SCORM report endpoint and does not require prior authentication. No public exploit code or active exploitation data (KEV, EPSS) has been observed at the time of analysis, but the high CVSS score and low attack complexity make it a serious risk if the endpoint is exposed.
RemediationAI
Apply the vendor-provided patch once available; the CSA advisory does not list a fixed version, so monitor vendor communications from Three Learning for updates. As a compensating control, restrict network access to the SCORM report endpoint to trusted hosts only, or disable the feature if not required for operations. Deploy a web application firewall (WAF) rule to detect and block SQL injection patterns targeting the endpoint. Note that disabling the endpoint may break SCORM reporting functionality, and WAF rules may be bypassed if the injection is obfuscated.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the SCORM report feature of Koollab LMS, a learning management system by Three Learning. The root cause is an error-based SQL injection (CWE not provided) in the endpoint that handles SCORM-related reporting, where user-supplied input is not properly sanitized before being used in SQL queries. The CPE cpe:2.3:a:three_learning:koollab_lms:*:*:*:*:*:*:*:* indicates all versions are potentially affected. The attack exploits database error messages to retrieve data, and because the endpoint is accessible without authentication, an attacker can execute arbitrary SQL queries to extract sensitive information.
Know when Koollab Lms gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Unauthenticated SQL injection allows high confidential data exposure and integrity impact from token misuse.
Primary rating from Vendor (CSA).
CVSS VectorVendor: CSA
DescriptionCVE.org
A pre-authentication error-based SQL injection vulnerability in Koollab LMS allowed an unauthenticated attacker to read sensitive database contents, including personally identifiable information, credentials, and valid JWT tokens that may enable account takeover, via the SCORM report endpoint.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
More in Koollab Lms
View allArbitrary file upload and remote code execution in Koollab LMS allows an authenticated module designer to achieve full s
Remote code execution in Koollab LMS 5.3.2 lets an authenticated attacker chain SQL injection (CWE-89) and PHP object in
Remote code execution in Koollab LMS allows authenticated attackers to chain SQL injection with unsafe deserialization,
Remote code execution in Koollab LMS allows authenticated attackers to exploit SQL injection and unsafe deserialization
Blind SQL injection in Koollab LMS enables unauthenticated attackers to exfiltrate sensitive database contents, includin
Error-based SQL injection in Koollab LMS 5.3.2 lets an authenticated attacker abuse the face-to-face runs update endpoin
An authentication bypass in Koollab LMS allows unauthenticated attackers to take over any account, including administrat
Exposure of hard-coded AWS IAM credentials in Koollab LMS 5.3.2 allows authenticated attackers with low privileges to ac
Two-factor authentication bypass in Koollab LMS allows attackers to supply a client-controlled TOTP seed and generate a
Koollab LMS 5.3.2 exposes correct quiz answers through the course status endpoint to authenticated learners without requ
Integrity compromise in Koollab LMS allows authenticated learners to falsify lesson completion records via the SCORM com
Forced session termination via the login kickout endpoint in Koollab LMS allows unauthenticated attackers to deny servic
Exploit-DB