This vulnerability in Koollab LMS (version 5.3.2) allows an authenticated user to perform an error-based SQL injection through the face-to-face runs update endpoint. Exploitation enables the attacker to read the full application database and extract valid JWT tokens, which can be used to take over accounts. The CVSS 3.1 score is 8.1, reflecting high impact on confidentiality and integrity with network attack vector, low attack complexity, and no user interaction required. There is no vendor advisory or patch available at this time.

Successful exploitation results in full disclosure of the application database contents and compromise of user accounts via valid JWT tokens. This leads to a high impact on confidentiality and integrity of the system. Availability is not affected. The vulnerability requires authentication but has low complexity and no user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected endpoint to trusted users only and monitor for suspicious activity related to account takeover attempts.