EUVD-2026-50129
GHSA-4q7v-f574-m5cv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege grading user
-
DeliverySubmit crafted payload to manual mark endpoint
-
ExploitTrigger SQLi and object injection into unserialize()
-
ExecutionWrite webshell to public directory
-
PersistRequest webshell URL
-
ImpactExecute arbitrary commands, full server compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated account (CVSS PR:L) with access to Koollab LMS's manual mark assessment endpoint - realistically a marker/instructor/grading role, not an anonymous user. The attacker must be able to submit input that reaches both the injectable SQL query and the unserialize() call on that endpoint, and the target must have a web-writable directory that is also publicly reachable for the webshell drop to be servable. Limiting factors: valid credentials with grading privileges are mandatory (no unauthenticated path), and success depends on a usable PHP object-injection gadget chain and a writable web-accessible path in the deployment. Affected/confirmed version is Koollab LMS 5.3.2. |
| Impact | Signals are mixed and should be weighed rather than taken at face value. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C, all impacts High) justifies the 9.9 rating and reflects genuinely severe technical impact (SSVC Technical Impact: total). However, exploitation likelihood indicators are low: EPSS is 0.30% (22nd percentile), CISA SSVC records Exploitation: none and Automatable: no, and there is no KEV listing and no public PoC. The PR:L requirement means an attacker must first hold a valid authenticated account (e.g., a marker/instructor role able to reach the assessment endpoint), which meaningfully limits the exploit population. Net assessment: high-severity-if-reached but currently low real-world exploitation pressure - prioritize patching for internet-exposed instances, but this is not an emergency mass-exploitation scenario on present evidence. Note the tension worth verifying: high CVSS/total impact versus low EPSS and SSVC 'none' suggests a serious but not-yet-exploited flaw rather than an active threat. |
| Exploit ScenarioDerived | An attacker with a low-privilege authenticated account (such as a marker or instructor) submits a crafted value to the manual mark assessment endpoint that both injects SQL and carries a malicious PHP serialized object; the object reaches unserialize() and is used to write a webshell into a publicly served directory. The attacker then browses to the webshell URL and executes OS commands as the web server user, achieving full server compromise. No public PoC is currently identified, and the network attack vector with low complexity makes the chain straightforward once account access is obtained. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Remote code execution in Koollab LMS 5.3.2 lets an authenticated attacker chain SQL injection (CWE-89) and PHP object injection through the manual mark assessment endpoint to poison data reaching unserialize(), drop a webshell into a web-accessible path, and run arbitrary commands on the host. The chained SQLi-to-deserialization-to-webshell path yields total system compromise (CVSS 9.9, scope change). There is no public exploit identified at time of analysis, EPSS is low (0.30%), and CISA SSVC currently rates exploitation as none.
RemediationAI
No vendor-released patch identified at time of analysis; no fixed version is stated in the available data, so contact Three Learning and monitor the CSA advisory (https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-094/) and NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-63234) for a patched release. As compensating controls until a fix ships: restrict network access to the LMS (place it behind VPN/IP allowlisting rather than public internet, trade-off being reduced remote access for legitimate users); tightly limit and audit accounts that hold marking/assessment privileges since exploitation requires an authenticated low-privilege account; deploy a WAF rule to block SQL metacharacters and PHP-serialized payloads (e.g., strings containing O:<n>:" object markers) against the manual mark assessment endpoint, accepting possible false positives on legitimate free-text marks; and make the web root and upload/temp directories non-executable for PHP (deny handler mapping) so a dropped webshell cannot run, with the trade-off of needing to confirm no legitimate scripts live there.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Koollab LMS (vendor Three Learning, CPE cpe:2.3:a:three_learning:koollab_lms) is a PHP-based learning management system. The root cause is CWE-89 SQL injection in the manual mark assessment endpoint, but the impact is amplified because attacker-controlled data flows into PHP's unserialize() - an unsafe deserialization sink (PHP object injection). When application classes define magic methods (__wakeup/__destruct) reachable as gadgets, unserialize() of hostile input can be steered to write a file (the webshell) to a publicly reachable directory, converting a data-layer injection into full code execution. The combination of an injectable query and a deserialization primitive is what elevates a typical SQLi to server takeover.
Know when Koollab Lms gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Network-reachable endpoint with low complexity but requires an authenticated grading account (PR:L); webshell escapes the app to OS, giving scope change and full C/I/A impact.
Primary rating from Vendor (CSA).
CVSS VectorVendor: CSA
DescriptionCVE.org
A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the manual mark assessment endpoint, control data passed to unserialize(), write a webshell to a publicly accessible location, and execute arbitrary code on the server.
Executive ViewAI
Koollab LMS through version 5.3.2 contains a critical remote code execution vulnerability (CVSS 9.9) enabling complete system compromise and arbitrary command execution. No vendor-released patch identified at time of analysis, requiring organizations to implement immediate defensive controls. For any organization running this learning platform, this represents a critical business risk requiring urgent mitigation despite current low exploitation activity.
Restrict network access to Koollab LMS and the manual mark assessment endpoint to authorized personnel only. Deploy Web Application Firewall rules to detect and block SQL injection and PHP object injection patterns. Enable detailed logging and alerting on assessment endpoint activity. Apply input validation and output encoding to user inputs targeting the vulnerable endpoint. Consider temporarily restricting LMS usage to essential functions only. Maintain close monitoring of vendor security advisories for patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Koollab Lms
View allArbitrary file upload and remote code execution in Koollab LMS allows an authenticated module designer to achieve full s
Remote code execution in Koollab LMS allows authenticated attackers to chain SQL injection with unsafe deserialization,
Remote code execution in Koollab LMS allows authenticated attackers to exploit SQL injection and unsafe deserialization
Error-based SQL injection in Koollab LMS allows unauthenticated attackers to exfiltrate sensitive database contents, inc
Blind SQL injection in Koollab LMS enables unauthenticated attackers to exfiltrate sensitive database contents, includin
Error-based SQL injection in Koollab LMS 5.3.2 lets an authenticated attacker abuse the face-to-face runs update endpoin
An authentication bypass in Koollab LMS allows unauthenticated attackers to take over any account, including administrat
Exposure of hard-coded AWS IAM credentials in Koollab LMS 5.3.2 allows authenticated attackers with low privileges to ac
Two-factor authentication bypass in Koollab LMS allows attackers to supply a client-controlled TOTP seed and generate a
Koollab LMS 5.3.2 exposes correct quiz answers through the course status endpoint to authenticated learners without requ
Integrity compromise in Koollab LMS allows authenticated learners to falsify lesson completion records via the SCORM com
Forced session termination via the login kickout endpoint in Koollab LMS allows unauthenticated attackers to deny servic
Exploit-DB