Unrestricted SCORM File Upload in Koollab LMS Leads to RCE

Executive Summary

This is an unrestricted SCORM file upload vulnerability in Koollab LMS version 5.3.2. An authenticated module designer can upload a SCORM package containing a PHP webshell to a publicly accessible directory. This allows the attacker to execute arbitrary code on the server.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized PHP files in publicly accessible directories, particularly in SCORM package upload locations. Review web server access logs for suspicious uploads or execution attempts. Look for unexpected PHP webshell files in directories like /uploads or /scorm.

Useful 0 Not Useful 0

Impact Analysis

An attacker could gain full control of the server hosting Koollab LMS. This could lead to data theft, unauthorized access to sensitive information, disruption of services, or further compromise of connected systems.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection and security. Organizations using affected versions may face compliance violations, legal penalties, and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Apply the official patch from Three Learning for cloud-hosted instances. If using an older version, update to the latest fixed release immediately. Disable SCORM uploads if not required or restrict upload permissions to trusted users only.

Useful 0 Not Useful 0