An authenticated attacker can exploit a SQL injection flaw combined with unsafe deserialization in the assessment overall answer endpoint of Koollab LMS. The vulnerability allows the attacker to inject arbitrary SQL, manipulate the data passed to unserialize(), write a webshell to a publicly accessible location, and then execute arbitrary code on the server. The primary impact is full remote code execution, giving the attacker complete control over the affected system.

The vulnerable component is part of Koollab LMS from Three Learning. No specific version numbers are disclosed in the advisory, so all releases that include the assessment overall answer endpoint are potentially affected until a vendor patch is applied.

The CVSS score of 9.9 indicates a critical severity, while the EPSS score of <1% suggests that exploitation attempts are currently rare. The vulnerability is not listed in CISA KEV, but the combination of SQL injection and unsafe deserialization creates a high‑risk attack path that requires authenticated access and a valid session. The attacker must first authenticate, then target the vulnerable endpoint to inject SQL and supply malicious serialized data to create a webshell and run code on the server.