EUVD-2026-50127
GHSA-pv86-vg4j-hq7j
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Network-based attack with low complexity, low-privileged auth, no user interaction; scope change due to webshell deployment leading to full CIA impact.
Primary rating from Vendor (CSA).
CVSS VectorVendor: CSA
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the assessment reinforcement endpoint, control data passed to unserialize(), write a webshell to a publicly accessible location, and execute arbitrary code on the server.
AnalysisAI
Remote code execution in Koollab LMS allows authenticated attackers to exploit SQL injection and unsafe deserialization through the assessment reinforcement endpoint, resulting in webshell upload and full server compromise. The vulnerability, tracked as CVE-2026-63232, requires low-privileged access but leads to complete takeover of the server. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | An authenticated user account with at least low-level privileges is required to access the assessment reinforcement feature. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 3.1 score of 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) indicates a critical risk due to network attack vector, low complexity, and high impact across confidentiality, integrity, and availability with scope change. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with low-privileged credentials sends a specially crafted request to the assessment reinforcement endpoint, injecting SQL commands that modify data passed to the unserialize() call. The resulting unsafe deserialization enables writing a PHP webshell to a publicly accessible directory, which is then accessed to execute arbitrary system commands on the server. |
| Remediation | Refer to the CSA advisory AL-2026-094 (https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-094/) for official patch information. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Koollab Lms
View allArbitrary file upload and remote code execution in Koollab LMS allows an authenticated module designer to achieve full s
Remote code execution in Koollab LMS 5.3.2 lets an authenticated attacker chain SQL injection (CWE-89) and PHP object in
Remote code execution in Koollab LMS allows authenticated attackers to chain SQL injection with unsafe deserialization,
Error-based SQL injection in Koollab LMS allows unauthenticated attackers to exfiltrate sensitive database contents, inc
Blind SQL injection in Koollab LMS enables unauthenticated attackers to exfiltrate sensitive database contents, includin
Error-based SQL injection in Koollab LMS 5.3.2 lets an authenticated attacker abuse the face-to-face runs update endpoin
An authentication bypass in Koollab LMS allows unauthenticated attackers to take over any account, including administrat
Exposure of hard-coded AWS IAM credentials in Koollab LMS 5.3.2 allows authenticated attackers with low privileges to ac
Two-factor authentication bypass in Koollab LMS allows attackers to supply a client-controlled TOTP seed and generate a
Koollab LMS 5.3.2 exposes correct quiz answers through the course status endpoint to authenticated learners without requ
Integrity compromise in Koollab LMS allows authenticated learners to falsify lesson completion records via the SCORM com
Forced session termination via the login kickout endpoint in Koollab LMS allows unauthenticated attackers to deny servic
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today