EUVD-2026-50127
GHSA-pv86-vg4j-hq7j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconAuthenticate with a low-privileged LMS account
-
DeliveryAccess the assessment reinforcement endpoint
-
ExploitInject a crafted SQL payload
-
InstallLeverage the injection to control data for unserialize()
-
C2Deserialize a malicious object that writes a webshell to a public directory
-
ExecuteExecute arbitrary commands via the webshell
-
ImpactAchieve full server compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | An authenticated user account with at least low-level privileges is required to access the assessment reinforcement feature. The vulnerability is triggered when this feature processes user input that is subsequently passed to unserialize() without proper sanitization. No other special conditions are needed; the attack works over the network with low complexity and no user interaction beyond the initial authentication. |
| Impact | CVSS 3.1 score of 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) indicates a critical risk due to network attack vector, low complexity, and high impact across confidentiality, integrity, and availability with scope change. The need for low-privileged authentication partially mitigates the risk, but once accessed, exploitation is straightforward. No EPSS score is available, and the CISA KEV catalog does not list this vulnerability. Without evidence of public exploit code or active exploitation, the real-world impact depends on the deployment footprint of Koollab LMS and the exposure of the affected endpoint. However, the CVSS suggests this should be treated as a high-priority issue for any organization running the software. |
| Exploit ScenarioDerived | An attacker with low-privileged credentials sends a specially crafted request to the assessment reinforcement endpoint, injecting SQL commands that modify data passed to the unserialize() call. The resulting unsafe deserialization enables writing a PHP webshell to a publicly accessible directory, which is then accessed to execute arbitrary system commands on the server. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 29, 2026
Remote code execution in Koollab LMS allows authenticated attackers to exploit SQL injection and unsafe deserialization through the assessment reinforcement endpoint, resulting in webshell upload and full server compromise. The vulnerability, tracked as CVE-2026-63232, requires low-privileged access but leads to complete takeover of the server. No public exploit or active exploitation has been identified at time of analysis.
RemediationAI
Refer to the CSA advisory AL-2026-094 (https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-094/) for official patch information. As an immediate workaround, restrict network access to the LMS application to trusted networks and enforce strict authentication controls. If the assessment reinforcement functionality is not business-critical, disable it entirely or limit access to highly privileged roles. Additionally, deploy a web application firewall to filter malicious SQL injection and serialization payloads targeting the endpoint.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Koollab LMS is a learning management system. The vulnerability involves two chained weaknesses: SQL injection, which allows an attacker to manipulate database queries, and unsafe deserialization via the unserialize() function, where attacker-controlled data is deserialized without validation. The CPE string cpe:2.3:a:three_learning:koollab_lms:*:*:*:*:*:*:*:* indicates all versions are affected. The affected component is the assessment reinforcement endpoint, which processes user-supplied data that is later passed to unserialize(), enabling arbitrary PHP object injection and code execution.
Know when Koollab Lms gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Network-based attack with low complexity, low-privileged auth, no user interaction; scope change due to webshell deployment leading to full CIA impact.
Primary rating from Vendor (CSA).
CVSS VectorVendor: CSA
DescriptionCVE.org
A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the assessment reinforcement endpoint, control data passed to unserialize(), write a webshell to a publicly accessible location, and execute arbitrary code on the server.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Koollab Lms
View allArbitrary file upload and remote code execution in Koollab LMS allows an authenticated module designer to achieve full s
Remote code execution in Koollab LMS 5.3.2 lets an authenticated attacker chain SQL injection (CWE-89) and PHP object in
Remote code execution in Koollab LMS allows authenticated attackers to chain SQL injection with unsafe deserialization,
Error-based SQL injection in Koollab LMS allows unauthenticated attackers to exfiltrate sensitive database contents, inc
Blind SQL injection in Koollab LMS enables unauthenticated attackers to exfiltrate sensitive database contents, includin
Error-based SQL injection in Koollab LMS 5.3.2 lets an authenticated attacker abuse the face-to-face runs update endpoin
An authentication bypass in Koollab LMS allows unauthenticated attackers to take over any account, including administrat
Exposure of hard-coded AWS IAM credentials in Koollab LMS 5.3.2 allows authenticated attackers with low privileges to ac
Two-factor authentication bypass in Koollab LMS allows attackers to supply a client-controlled TOTP seed and generate a
Koollab LMS 5.3.2 exposes correct quiz answers through the course status endpoint to authenticated learners without requ
Integrity compromise in Koollab LMS allows authenticated learners to falsify lesson completion records via the SCORM com
Forced session termination via the login kickout endpoint in Koollab LMS allows unauthenticated attackers to deny servic
Exploit-DB