Overview
CVE-2026-63232 is a critical-severity vulnerability (CVSS 9.9) affecting Koollab LMS, a learning management system. The flaw combines SQL injection with unsafe PHP unserialize() usage in the platform's assessment reinforcement endpoint, enabling an authenticated attacker to achieve remote code execution (RCE) on the underlying server.
Technical Details
The vulnerability exists in Koollab LMS's assessment reinforcement endpoint, where user-supplied input is passed unsanitised into SQL queries and subsequently fed into PHP's unserialize() function without validation.
The attack chain is as follows:
- SQL Injection — an authenticated user crafts a malicious payload through the assessment reinforcement endpoint that manipulates the underlying database query.
- Unsafe Deserialisation — the attacker controls data passed to
unserialize(), enabling PHP object injection. - Webshell Write — by exploiting the deserialisation gadget chain, the attacker writes a PHP webshell to a publicly accessible directory on the server.
- Remote Code Execution — the attacker sends HTTP requests to the dropped webshell to execute arbitrary OS commands as the web server user.
Impact
- Confidentiality: Full read access to server filesystem and database contents, including student PII, credentials, and course materials.
- Integrity: Ability to modify or delete LMS data, course content, and user records.
- Availability: Server can be taken offline or repurposed for further attacks.
Because the CVSS score is 9.9, the attack requires only authentication — no special privileges or user interaction beyond a standard LMS account — making this accessible to any enrolled student or staff member.
Affected Software
| Product | Affected Versions |
|---|---|
| Koollab LMS | Unspecified (see vendor advisory) |
Remediation
- Apply vendor patches immediately. Check the Koollab LMS vendor portal or NVD for patched versions.
- Restrict access to the assessment reinforcement endpoint to trusted roles while patches are being applied.
- Audit logs for unusual requests to the affected endpoint.
- Remove unserialise() usage wherever possible; prefer
json_decode()for structured data. - Web Application Firewall (WAF) rules targeting SQL injection patterns can reduce exposure in the interim.
References
- NVD — CVE-2026-63232
- CVSS Score: 9.9 Critical