This vulnerability in Koollab LMS version 5.3.2 allows an attacker with authentication to perform SQL injection and unsafe deserialization via the assessment overall answer endpoint. Exploitation enables the attacker to control the data passed to PHP's unserialize() function, leading to arbitrary code execution by writing a webshell to a location accessible over the web. The CVSS 3.1 base score is 9.9, indicating critical severity with network attack vector, low attack complexity, requiring privileges but no user interaction, and impacts confidentiality, integrity, and availability with high severity. No official patch or remediation is currently documented.

Successful exploitation can lead to full compromise of the affected server, including arbitrary code execution, data breach, and persistent backdoor installation via webshell. The vulnerability affects confidentiality, integrity, and availability of the system at a critical level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the assessment overall answer endpoint to trusted users only and monitor for suspicious activity. Avoid using version 5.3.2 in production environments if possible.