Koollab LMS vulnerabilities

Koollab LMS has a SQL injection and unsafe deserialization vulnerability in the manual mark assessment endpoint. An authenticated attacker can inject SQL, control data passed to unserialize(), write a webshell to a publicly accessible location, and execute arbitrary code on the server.

Koollab LMS has a SQL injection and unsafe deserialization vulnerability in the assessment overall answer endpoint. An authenticated attacker can inject SQL, control data passed to unserialize(), write a webshell to a publicly accessible location, and execute arbitrary code on the server.

Koollab LMS has a SQL injection and unsafe deserialization vulnerability in the assessment reinforcement endpoint. An authenticated attacker can inject SQL, control data passed to unserialize(), write a webshell to a publicly accessible location, and execute arbitrary code on the server.

Koollab LMS has a pre-authentication error-based SQL injection vulnerability in the SCORM report endpoint. An unauthenticated attacker can read sensitive database contents, including personally identifiable information, credentials, and valid JWT tokens, potentially enabling account takeover.

Koollab LMS has a pre-authentication blind SQL injection vulnerability in the SSO OAuth endpoint. An unauthenticated attacker can use a time-based SQL oracle to read sensitive database contents, including personally identifiable information, credentials, and valid JWT tokens, potentially enabling account takeover.

Koollab LMS has an unrestricted SCORM file upload vulnerability. An authenticated module designer can upload a SCORM package containing a PHP webshell to a publicly accessible directory and execute arbitrary code on the server.

Koollab LMS has a business logic vulnerability that allows an authenticated learner to set their lesson completion status to completed via the SCORM commit endpoint without viewing the lesson material, compromising training and completion records.

An insecure direct object reference vulnerability in Koollab LMS allowed an authenticated user to query the course completion progress of any other user without authorisation, disclosing private learning progress information.

An information disclosure vulnerability in Koollab LMS allowed an authenticated learner to obtain correct quiz answers from the course status endpoint without completing the assessment legitimately, compromising assessment integrity.

A hard-coded AWS IAM credentials vulnerability in Koollab LMS allowed an attacker to access shared multi-tenant S3 buckets and SQS queues, exposing sensitive data and enabling malicious content injection, job manipulation, or email interception.

An authentication bypass vulnerability in Koollab LMS allowed an unauthenticated attacker to take over any account, including administrator accounts, by supplying a valid user UUID without providing primary credentials via the 2FA validation endpoint.

A TOTP two-factor authentication bypass vulnerability in Koollab LMS allowed an attacker to supply a client-controlled seed to generate a matching one-time password and bypass the second authentication factor, potentially enabling unauthorised access to administrator accounts.

An improper access control vulnerability in Koollab LMS allowed an unauthenticated attacker to read another user's name, internal identifier, scores, lesson status, lesson position, and cached lesson state via the SCORM API endpoint.

An unauthenticated attacker can forcibly terminate the session of any Koollab LMS user by knowing their email address via the login kickout endpoint, leading to denial of service.

A post-authentication SQL injection vulnerability was found in Koollab LMS. An authenticated attacker can use the face-to-face runs update endpoint to read the entire database and obtain valid JWT tokens for account takeover.

An authenticated attacker can upload malicious content disguised as an image file via the feedback mail registration endpoint in Koollab LMS due to unrestricted image upload.