This vulnerability in Koollab LMS (version 5.3.2) is an error-based SQL injection that can be exploited without authentication through the SCORM report endpoint. Successful exploitation enables attackers to read sensitive data from the database, including PII, user credentials, and JWT tokens, which may facilitate account takeover. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) reflects network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality and integrity impact with no availability impact. No official patch or remediation guidance is currently available from the vendor.

An attacker can remotely exploit this vulnerability without authentication to extract sensitive data such as personally identifiable information, credentials, and valid JWT tokens. This exposure can lead to account compromise and unauthorized access to user accounts within Koollab LMS. The integrity and confidentiality of the system are severely impacted, but availability is not affected. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the SCORM report endpoint if possible and monitor for suspicious activity. Avoid exposing the vulnerable version (5.3.2) to untrusted networks. Follow vendor updates closely for official patches or mitigations.