This vulnerability in Koollab LMS version 5.3.2 combines SQL injection and unsafe deserialization flaws. An authenticated attacker can exploit the assessment reinforcement endpoint to inject SQL commands and manipulate data passed to the PHP unserialize() function. This enables the attacker to write a webshell to a location accessible via the web server, resulting in remote code execution with the privileges of the application.

Successful exploitation can lead to full compromise of the affected server, including complete confidentiality, integrity, and availability loss. The attacker can execute arbitrary code remotely, potentially leading to data theft, service disruption, or further network pivoting.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided at this time. Until a patch is available, restrict authenticated user privileges and monitor for suspicious activity related to the assessment reinforcement endpoint.