This vulnerability in Koollab LMS 5.3.2 allows an authenticated user to exploit a SQL injection and unsafe deserialization flaw via the assessment overall answer endpoint. By manipulating input, the attacker can control the data passed to PHP's unserialize() function, resulting in the ability to write a webshell to the server and execute arbitrary code remotely. The CVSS 3.1 base score is 9.9, indicating critical severity with network attack vector, low attack complexity, and no user interaction required. The vulnerability impacts confidentiality, integrity, and availability at a high level. No official patch or remediation guidance is currently available from the vendor, and no known exploits in the wild have been reported.

Successful exploitation allows an authenticated attacker to execute arbitrary code on the server hosting Koollab LMS 5.3.2. This compromises the confidentiality, integrity, and availability of the affected system, potentially leading to full system compromise and unauthorized access to sensitive data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the assessment overall answer endpoint to trusted users only and monitor for suspicious activity. Avoid exposing the LMS server to untrusted networks and consider additional application-layer protections to mitigate exploitation risk.