Pre-Auth SQL Injection in Koollab LMS

Executive Summary

This is a pre-authentication SQL injection flaw in Koollab LMS. It allows an unauthenticated attacker to inject malicious SQL queries into the SCORM report endpoint. The flaw enables reading sensitive database contents like personally identifiable information, credentials, and valid JWT tokens.

Useful 0 Not Useful 0

Detection Guidance

Detecting this SQL injection vulnerability requires checking for unusual database queries or errors in Koollab LMS logs. Monitor the SCORM report endpoint for unexpected input patterns or error messages. Use tools like SQLmap to test for injection flaws, but only in authorized environments.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to steal sensitive data such as user credentials, personal information, or JWT tokens. This could lead to account takeover, unauthorized access to systems, or further attacks using the stolen tokens.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to breaches of GDPR due to exposure of personally identifiable information and HIPAA due to potential compromise of credentials or sensitive health-related data. Non-compliance penalties and legal consequences may follow.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately patch Koollab LMS to the latest version. Disable the SCORM report endpoint if not required. Implement input validation and parameterized queries to prevent SQL injection. Rotate all exposed credentials and JWT tokens.

Useful 0 Not Useful 0