This vulnerability in Koollab LMS 5.3.2 involves an unrestricted file upload flaw in the SCORM module. An authenticated user with module designer privileges can upload a specially crafted SCORM package embedding a PHP webshell. The uploaded file is placed in a publicly accessible directory, allowing the attacker to execute arbitrary code on the server remotely. The CVSS 3.1 base score is 9.9, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and complete confidentiality, integrity, and availability impact.

Successful exploitation results in remote code execution on the LMS server with the privileges of the web server process. This can lead to full system compromise, data theft, service disruption, and further lateral movement within the network. The vulnerability requires authenticated access with module designer privileges but no user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict module designer privileges to trusted users only and monitor for suspicious file uploads. Consider disabling SCORM package uploads if feasible.