This vulnerability in Koollab LMS 5.3.2 allows an attacker with authentication to perform SQL injection and unsafe deserialization attacks through the manual mark assessment endpoint. By manipulating input, the attacker can control the data passed to PHP's unserialize() function, enabling them to write a webshell to a location accessible via the web and execute arbitrary code on the server. The CVSS 3.1 base score is 9.9, reflecting critical impact with network attack vector, low attack complexity, requiring privileges but no user interaction, and resulting in complete confidentiality, integrity, and availability compromise.

Successful exploitation allows an authenticated attacker to execute arbitrary code on the server hosting Koollab LMS 5.3.2, potentially leading to full system compromise. This includes unauthorized data access, modification, and service disruption. The vulnerability combines SQL injection and unsafe deserialization, increasing the attack surface and severity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been documented at this time. Until a patch is available, restrict access to the manual mark assessment endpoint to trusted users only and monitor for suspicious activity related to deserialization and file writes.