A critical file upload vulnerability in Koollab LMS 5.3.2 allows an authenticated attacker to achieve remote code execution on the underlying server.

The application fails to properly validate the file type of uploaded SCORM packages. This allows an authenticated user with module designer privileges to upload malicious PHP scripts to a publicly accessible directory, leading to arbitrary code execution.

This vulnerability is assigned a critical CVSS score of 9.9, reflecting the high potential for total system compromise. Successful exploitation grants an attacker full control over the application server, which can lead to unauthorized access to sensitive institutional data, the deployment of ransomware, or lateral movement within the network.

Immediate Action: Upgrade Koollab LMS to version 5.4.0 or later to implement proper file validation controls.

Proactive Monitoring: Review web server access logs for requests directed at unexpected PHP files within the application directory structure.

Compensating Controls: Implement strict directory permissions to prevent execution of scripts in upload directories and deploy a Web Application Firewall to block suspicious file upload patterns.

Public Exploit Available: No

Given the critical nature of this vulnerability and the potential for complete system takeover, organizations using Koollab LMS must prioritize the update to version 5.4.0. Immediate patching is the only effective way to neutralize the risk of unauthorized code execution via malicious SCORM packages.