EUVD-2026-50129
GHSA-4q7v-f574-m5cv
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Network-reachable endpoint with low complexity but requires an authenticated grading account (PR:L); webshell escapes the app to OS, giving scope change and full C/I/A impact.
Primary rating from Vendor (CSA).
CVSS VectorVendor: CSA
Lifecycle Timeline
2DescriptionCVE.org
A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the manual mark assessment endpoint, control data passed to unserialize(), write a webshell to a publicly accessible location, and execute arbitrary code on the server.
AnalysisAI
Remote code execution in Koollab LMS 5.3.2 lets an authenticated attacker chain SQL injection (CWE-89) and PHP object injection through the manual mark assessment endpoint to poison data reaching unserialize(), drop a webshell into a web-accessible path, and run arbitrary commands on the host. The chained SQLi-to-deserialization-to-webshell path yields total system compromise (CVSS 9.9, scope change). There is no public exploit identified at time of analysis, EPSS is low (0.30%), and CISA SSVC currently rates exploitation as none.
Technical ContextAI
Koollab LMS (vendor Three Learning, CPE cpe:2.3:a:three_learning:koollab_lms) is a PHP-based learning management system. The root cause is CWE-89 SQL injection in the manual mark assessment endpoint, but the impact is amplified because attacker-controlled data flows into PHP's unserialize() - an unsafe deserialization sink (PHP object injection). When application classes define magic methods (__wakeup/__destruct) reachable as gadgets, unserialize() of hostile input can be steered to write a file (the webshell) to a publicly reachable directory, converting a data-layer injection into full code execution. The combination of an injectable query and a deserialization primitive is what elevates a typical SQLi to server takeover.
RemediationAI
No vendor-released patch identified at time of analysis; no fixed version is stated in the available data, so contact Three Learning and monitor the CSA advisory (https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-094/) and NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-63234) for a patched release. As compensating controls until a fix ships: restrict network access to the LMS (place it behind VPN/IP allowlisting rather than public internet, trade-off being reduced remote access for legitimate users); tightly limit and audit accounts that hold marking/assessment privileges since exploitation requires an authenticated low-privilege account; deploy a WAF rule to block SQL metacharacters and PHP-serialized payloads (e.g., strings containing O:<n>:" object markers) against the manual mark assessment endpoint, accepting possible false positives on legitimate free-text marks; and make the web root and upload/temp directories non-executable for PHP (deny handler mapping) so a dropped webshell cannot run, with the trade-off of needing to confirm no legitimate scripts live there.
More in Koollab Lms
View allArbitrary file upload and remote code execution in Koollab LMS allows an authenticated module designer to achieve full s
Remote code execution in Koollab LMS allows authenticated attackers to chain SQL injection with unsafe deserialization,
Remote code execution in Koollab LMS allows authenticated attackers to exploit SQL injection and unsafe deserialization
Error-based SQL injection in Koollab LMS allows unauthenticated attackers to exfiltrate sensitive database contents, inc
Blind SQL injection in Koollab LMS enables unauthenticated attackers to exfiltrate sensitive database contents, includin
Error-based SQL injection in Koollab LMS 5.3.2 lets an authenticated attacker abuse the face-to-face runs update endpoin
An authentication bypass in Koollab LMS allows unauthenticated attackers to take over any account, including administrat
Exposure of hard-coded AWS IAM credentials in Koollab LMS 5.3.2 allows authenticated attackers with low privileges to ac
Two-factor authentication bypass in Koollab LMS allows attackers to supply a client-controlled TOTP seed and generate a
Koollab LMS 5.3.2 exposes correct quiz answers through the course status endpoint to authenticated learners without requ
Integrity compromise in Koollab LMS allows authenticated learners to falsify lesson completion records via the SCORM com
Forced session termination via the login kickout endpoint in Koollab LMS allows unauthenticated attackers to deny servic
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today