This vulnerability in Koollab LMS version 5.3.2 is an error-based SQL injection exploitable without authentication through the SCORM report endpoint. Successful exploitation permits attackers to read sensitive database contents such as PII, credentials, and JWT tokens, which may facilitate account takeover. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) reflects network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality and integrity impact with no availability impact. No official patch or remediation guidance is currently provided by the vendor, and no known exploits are reported in the wild.

An attacker can remotely exploit this vulnerability without authentication to extract sensitive data from the database, including personal information, user credentials, and valid JWT tokens. This can lead to account compromise and unauthorized access to the LMS system. The confidentiality and integrity of the system are severely impacted, but availability is not affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the SCORM report endpoint if possible and monitor for unusual activity. Avoid exposing the vulnerable version (5.3.2) in untrusted networks. Follow up with the vendor for updates on patches or official mitigations.