EUVD-2026-50125
GHSA-7j7j-vvxx-737q
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Unauthenticated SQL injection allows high confidential data exposure and integrity impact from token misuse.
Primary rating from Vendor (CSA).
CVSS VectorVendor: CSA
Lifecycle Timeline
2DescriptionCVE.org
A pre-authentication error-based SQL injection vulnerability in Koollab LMS allowed an unauthenticated attacker to read sensitive database contents, including personally identifiable information, credentials, and valid JWT tokens that may enable account takeover, via the SCORM report endpoint.
AnalysisAI
Error-based SQL injection in Koollab LMS allows unauthenticated attackers to exfiltrate sensitive database contents, including user credentials and JWT tokens that may enable account takeover. The vulnerability, reported through Singapore’s CSA, affects the SCORM report endpoint and does not require prior authentication. No public exploit code or active exploitation data (KEV, EPSS) has been observed at the time of analysis, but the high CVSS score and low attack complexity make it a serious risk if the endpoint is exposed.
Technical ContextAI
The vulnerability resides in the SCORM report feature of Koollab LMS, a learning management system by Three Learning. The root cause is an error-based SQL injection (CWE not provided) in the endpoint that handles SCORM-related reporting, where user-supplied input is not properly sanitized before being used in SQL queries. The CPE cpe:2.3:a:three_learning:koollab_lms:*:*:*:*:*:*:*:* indicates all versions are potentially affected. The attack exploits database error messages to retrieve data, and because the endpoint is accessible without authentication, an attacker can execute arbitrary SQL queries to extract sensitive information.
RemediationAI
Apply the vendor-provided patch once available; the CSA advisory does not list a fixed version, so monitor vendor communications from Three Learning for updates. As a compensating control, restrict network access to the SCORM report endpoint to trusted hosts only, or disable the feature if not required for operations. Deploy a web application firewall (WAF) rule to detect and block SQL injection patterns targeting the endpoint. Note that disabling the endpoint may break SCORM reporting functionality, and WAF rules may be bypassed if the injection is obfuscated.
More in Koollab Lms
View allArbitrary file upload and remote code execution in Koollab LMS allows an authenticated module designer to achieve full s
Remote code execution in Koollab LMS 5.3.2 lets an authenticated attacker chain SQL injection (CWE-89) and PHP object in
Remote code execution in Koollab LMS allows authenticated attackers to chain SQL injection with unsafe deserialization,
Remote code execution in Koollab LMS allows authenticated attackers to exploit SQL injection and unsafe deserialization
Blind SQL injection in Koollab LMS enables unauthenticated attackers to exfiltrate sensitive database contents, includin
Error-based SQL injection in Koollab LMS 5.3.2 lets an authenticated attacker abuse the face-to-face runs update endpoin
An authentication bypass in Koollab LMS allows unauthenticated attackers to take over any account, including administrat
Exposure of hard-coded AWS IAM credentials in Koollab LMS 5.3.2 allows authenticated attackers with low privileges to ac
Two-factor authentication bypass in Koollab LMS allows attackers to supply a client-controlled TOTP seed and generate a
Koollab LMS 5.3.2 exposes correct quiz answers through the course status endpoint to authenticated learners without requ
Integrity compromise in Koollab LMS allows authenticated learners to falsify lesson completion records via the SCORM com
Forced session termination via the login kickout endpoint in Koollab LMS allows unauthenticated attackers to deny servic
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today