EUVD-2026-50126
GHSA-7q3f-f53f-7cpq
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Network endpoint, low complexity, any authenticated account (PR:L); full DB read plus token theft give C:H/I:H, no availability impact so A:N.
Primary rating from Vendor (CSA).
CVSS VectorVendor: CSA
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
2DescriptionCVE.org
A post-authentication SQL injection vulnerability in Koollab LMS allowed an authenticated attacker to use an error-based SQL oracle via the face-to-face runs update endpoint to read the entire application database and obtain valid JWT tokens for account takeover.
AnalysisAI
Error-based SQL injection in Koollab LMS 5.3.2 lets an authenticated attacker abuse the face-to-face runs update endpoint as a SQL oracle to exfiltrate the entire application database, including valid JWT tokens that enable full account takeover. Rated CVSS 8.1 with high confidentiality and integrity impact; there is no public exploit identified at time of analysis and EPSS is low at 0.25% (17th percentile). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid authenticated Koollab LMS account (CVSS PR:L) and network reachability to the face-to-face runs update endpoint (AV:N/AC:L, no user interaction). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are largely consistent and point to a genuine but not emergency-level priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker holding any low-privilege Koollab LMS account (e.g., a student or instructor login) sends crafted input to the face-to-face runs update endpoint, using database error responses as a boolean/error oracle to iteratively extract table contents. Over many requests they reconstruct stored credentials and JWT tokens, then replay a valid administrator token to take over privileged accounts. … |
| Remediation | No vendor-released patch version is identified at time of analysis; the available references (CSA advisory AL-2026-094 at https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-094/ and the NVD record at https://nvd.nist.gov/vuln/detail/CVE-2026-63231) do not cite a fixed release, so upgrade to a vendor-supplied fixed build of Koollab LMS as soon as Three Learning publishes one and monitor those advisories. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Audit systems running Koollab LMS 5.3.2; disable the face-to-face runs endpoint if operationally feasible; enable database access logging and implement WAF rules to detect SQL injection attempts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Koollab Lms
View allArbitrary file upload and remote code execution in Koollab LMS allows an authenticated module designer to achieve full s
Remote code execution in Koollab LMS 5.3.2 lets an authenticated attacker chain SQL injection (CWE-89) and PHP object in
Remote code execution in Koollab LMS allows authenticated attackers to chain SQL injection with unsafe deserialization,
Remote code execution in Koollab LMS allows authenticated attackers to exploit SQL injection and unsafe deserialization
Error-based SQL injection in Koollab LMS allows unauthenticated attackers to exfiltrate sensitive database contents, inc
Blind SQL injection in Koollab LMS enables unauthenticated attackers to exfiltrate sensitive database contents, includin
An authentication bypass in Koollab LMS allows unauthenticated attackers to take over any account, including administrat
Exposure of hard-coded AWS IAM credentials in Koollab LMS 5.3.2 allows authenticated attackers with low privileges to ac
Two-factor authentication bypass in Koollab LMS allows attackers to supply a client-controlled TOTP seed and generate a
Koollab LMS 5.3.2 exposes correct quiz answers through the course status endpoint to authenticated learners without requ
Integrity compromise in Koollab LMS allows authenticated learners to falsify lesson completion records via the SCORM com
Forced session termination via the login kickout endpoint in Koollab LMS allows unauthenticated attackers to deny servic
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today