EUVD-2026-50127
GHSA-pv86-vg4j-hq7j
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Network-based attack with low complexity, low-privileged auth, no user interaction; scope change due to webshell deployment leading to full CIA impact.
Primary rating from Vendor (CSA).
CVSS VectorVendor: CSA
Lifecycle Timeline
2DescriptionCVE.org
A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the assessment reinforcement endpoint, control data passed to unserialize(), write a webshell to a publicly accessible location, and execute arbitrary code on the server.
AnalysisAI
Remote code execution in Koollab LMS allows authenticated attackers to exploit SQL injection and unsafe deserialization through the assessment reinforcement endpoint, resulting in webshell upload and full server compromise. The vulnerability, tracked as CVE-2026-63232, requires low-privileged access but leads to complete takeover of the server. No public exploit or active exploitation has been identified at time of analysis.
Technical ContextAI
Koollab LMS is a learning management system. The vulnerability involves two chained weaknesses: SQL injection, which allows an attacker to manipulate database queries, and unsafe deserialization via the unserialize() function, where attacker-controlled data is deserialized without validation. The CPE string cpe:2.3:a:three_learning:koollab_lms:*:*:*:*:*:*:*:* indicates all versions are affected. The affected component is the assessment reinforcement endpoint, which processes user-supplied data that is later passed to unserialize(), enabling arbitrary PHP object injection and code execution.
RemediationAI
Refer to the CSA advisory AL-2026-094 (https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-094/) for official patch information. As an immediate workaround, restrict network access to the LMS application to trusted networks and enforce strict authentication controls. If the assessment reinforcement functionality is not business-critical, disable it entirely or limit access to highly privileged roles. Additionally, deploy a web application firewall to filter malicious SQL injection and serialization payloads targeting the endpoint.
More in Koollab Lms
View allArbitrary file upload and remote code execution in Koollab LMS allows an authenticated module designer to achieve full s
Remote code execution in Koollab LMS 5.3.2 lets an authenticated attacker chain SQL injection (CWE-89) and PHP object in
Remote code execution in Koollab LMS allows authenticated attackers to chain SQL injection with unsafe deserialization,
Error-based SQL injection in Koollab LMS allows unauthenticated attackers to exfiltrate sensitive database contents, inc
Blind SQL injection in Koollab LMS enables unauthenticated attackers to exfiltrate sensitive database contents, includin
Error-based SQL injection in Koollab LMS 5.3.2 lets an authenticated attacker abuse the face-to-face runs update endpoin
An authentication bypass in Koollab LMS allows unauthenticated attackers to take over any account, including administrat
Exposure of hard-coded AWS IAM credentials in Koollab LMS 5.3.2 allows authenticated attackers with low privileges to ac
Two-factor authentication bypass in Koollab LMS allows attackers to supply a client-controlled TOTP seed and generate a
Koollab LMS 5.3.2 exposes correct quiz answers through the course status endpoint to authenticated learners without requ
Integrity compromise in Koollab LMS allows authenticated learners to falsify lesson completion records via the SCORM com
Forced session termination via the login kickout endpoint in Koollab LMS allows unauthenticated attackers to deny servic
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today