CVE-2026-63232
Deferred Deferred - Pending Action

SQL Injection and Unsafe Deserialization in Koollab LMS

Publication date: 2026-07-29

Last updated on: 2026-07-29

Assigner: CSA

Description
A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the assessment reinforcement endpoint, control data passed to unserialize(), write a webshell to a publicly accessible location, and execute arbitrary code on the server.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-29
Last Modified
2026-07-29
Generated
2026-08-18
AI Q&A
2026-07-29
EPSS Evaluated
2026-08-17
NVD
CVE-2026-63232
EUVD
EUVD-2026-50127

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
koollab lms *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves SQL injection and unsafe deserialization in Koollab LMS. An authenticated attacker could exploit the assessment reinforcement endpoint to inject malicious SQL queries and control data passed to the unserialize function. This could allow writing a webshell to a publicly accessible location and executing arbitrary code on the server.

Detection Guidance

Detecting this vulnerability requires checking for SQL injection attempts and unsafe deserialization in the Koollab LMS assessment reinforcement endpoint. Monitor server logs for suspicious POST requests to /assessment/reinforcement with payloads containing SQL keywords or serialized data. Use tools like SQLMap to test for SQL injection or Burp Suite to inspect requests for unserialize() parameters.

Impact Analysis

An attacker could gain full control over the server hosting Koollab LMS, leading to unauthorized data access, modification, or deletion. Sensitive information like user credentials, personal data, or intellectual property could be compromised. The server could also be used as a launchpad for further attacks.

Compliance Impact

This vulnerability could lead to severe compliance violations. GDPR requires protecting personal data; a breach could result in fines up to 4% of global revenue. HIPAA mandates safeguarding health data; a breach could lead to penalties and legal action. Non-compliance risks reputational damage and regulatory penalties.

Mitigation Strategies

Immediately update Koollab LMS to the latest patched version. Disable the assessment reinforcement endpoint if not required. Implement input validation and output encoding for all user inputs. Restrict file write permissions to prevent webshell creation. Monitor server logs for suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63232. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart