Loading vulnerability…
Pre-authentication SQL Injection in Koollab LMS SCORM Report Endpoint
CVE-2026-63230 is a critical pre-authentication error-based SQL injection vulnerability affecting Koollab LMS version 5.3.2. The flaw is present in the SCORM report endpoint, where insufficient neutralization of attacker-controlled input in SQL queries allows unauthenticated remote attackers to trigger database errors and use them as an oracle to extract backend database contents. Successful exploitation can expose sensitive application data, including personally identifiable information, stored credentials, and valid JWT tokens. Because the issue is reachable before authentication and requires no user interaction, it presents a direct remote attack surface with significant risk of downstream account compromise.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an unauthenticated attacker to read sensitive database contents from the Koollab LMS backend. Exposed information may include personally identifiable information, credentials, and valid JWT tokens. Disclosure of valid tokens and credential material can enable unauthorized access and account takeover, including compromise of higher-privileged accounts depending on the data retrieved. The reported CVSS v3.1 vector indicates high confidentiality impact and high integrity impact, with no stated availability impact.
If you can’t patch tonight, do this now.
Where immediate remediation cannot be independently verified, restrict exposure to the vulnerable endpoint as much as operationally possible, apply compensating controls such as web application firewall rules designed to detect and block SQL injection patterns, and monitor for anomalous requests to the SCORM reporting functionality. Review authentication logs and token usage for signs of abuse, rotate exposed credentials and JWT signing or validation material as appropriate, and invalidate active tokens that may have been disclosed.
Patch, then assume compromise.
Vendor fixes were rolled out for affected Koollab LMS cloud-hosted SaaS instances on 2026-04-26. Affected deployments should ensure they are running the remediated service version provided by Three Learning. The underlying issue should be addressed by correcting the vulnerable SQL construction in the SCORM report endpoint through parameterized queries or prepared statements, strict server-side input validation, and elimination of database error leakage to the client.
No public exploits tracked yet. Mallory keeps watching.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.