This vulnerability in Koollab LMS 5.3.2 allows an authenticated attacker to perform SQL injection and unsafe deserialization through the assessment reinforcement endpoint. By controlling the input to the unserialize() function, the attacker can write a webshell on the server and achieve remote code execution. The CVSS 3.1 base score is 9.9, reflecting the critical impact with network attack vector, low attack complexity, required privileges, no user interaction, and complete confidentiality, integrity, and availability impact.

Successful exploitation leads to remote code execution on the server hosting Koollab LMS, allowing the attacker to execute arbitrary commands, potentially compromising the entire system. This can result in full system compromise, data theft, service disruption, and persistent unauthorized access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the assessment reinforcement endpoint to trusted users only and monitor for suspicious activity. Avoid running the LMS with excessive privileges to limit potential damage.