Multiple Koollab LMS flaws enable SQL injection, account takeover, and RCE

Three Learning's Koollab LMS 5.3.2 was disclosed with multiple high-severity vulnerabilities that can expose databases, enable account takeover, and lead to remote code execution. The most critical issues include pre-authentication SQL injection in the SSO OAuth endpoint (CVE-2026-63229) and SCORM report endpoint (CVE-2026-63230), which allow unauthenticated attackers to read sensitive database contents such as personally identifiable information, credentials, and valid JWT tokens. A post-authentication SQL injection in the face-to-face runs update endpoint (CVE-2026-63231) can also expose the full application database and help attackers obtain JWTs for takeover of user accounts.

The advisory also details several paths to server-side code execution. An unrestricted SCORM upload flaw (CVE-2026-63227) lets an authenticated module designer place a PHP webshell in a publicly accessible directory, while two SQL injection and unsafe deserialization chains in the assessment reinforcement and manual mark assessment endpoints (CVE-2026-63232, CVE-2026-63234) allow authenticated attackers to influence data passed to unserialize(), write webshells, and execute arbitrary code on the server. Singapore's Cyber Security Agency said the broader disclosure covers 16 vulnerabilities across remote code execution, authentication bypass, access control, information disclosure, and business logic weaknesses, and that fixes were rolled out to all cloud-hosted SaaS instances by Three Learning.