A flaw in Koollab LMS’s assessment reinforcement endpoint allows an authenticated user to inject SQL and control data passed to unserialize(). This dual vulnerability enables the attacker to write a webshell to a publicly accessible location and execute arbitrary code on the hosting server. The key weakness is reflected in CWE‑89, indicating a mismatch between user input and database queries leading to data manipulation and unsafe deserialization. The overall effect is a remote code execution scenario that compromises server integrity and confidentiality.

The single affected product is Koollab LMS from Three Learning. No specific version numbers are noted in the available data, so all installations should be reviewed for this vulnerability.

The CVSS score of 9.9 marks the flaw as critical, while the EPSS score of less than 1 percent indicates a low probability of immediate exploitation. The vulnerability is not listed in CISA’s KEV catalog. The likely attack path requires an authenticated session to the LMS, suggesting that compromised credentials or a malicious user account would be a prerequisite. Once accessed, the endpoint can be leveraged to inject malicious SQL and supply crafted serialized objects, leading to successful code execution. Given the high severity and the broad impact on the server, the risk remains significant despite the low exploitation likelihood.