A post-authentication SQL injection vulnerability in Koollab LMS allows an authenticated attacker to compromise the entire application database and hijack user accounts.

This is a post-authentication SQL injection vulnerability, meaning an attacker must have valid user credentials to initiate the attack. By sending malicious input to the face-to-face runs update endpoint, an attacker can leverage an error-based SQL oracle to extract sensitive information from the database, including valid JSON Web Tokens (JWT).

The ability to extract data from the entire application database represents a critical risk to confidentiality and integrity. Successful exploitation could lead to widespread account takeovers, including administrative accounts, resulting in unauthorized access to sensitive learning materials and user records. The CVSS score of 8.1 reflects the severe impact of this vulnerability on data security.

Immediate Action: Contact the vendor or consult the official advisory at the provided reference to obtain the latest security patches.

Proactive Monitoring: Review application logs for anomalous database queries or unexpected errors originating from the face-to-face runs update endpoint.

Compensating Controls: Implement strict Web Application Firewall (WAF) rules to detect and block SQL injection patterns, and enforce strict database access controls.

Public Exploit Available: No

Organizations utilizing Koollab LMS version 5.3.2 must treat this vulnerability with high priority. Administrators should apply available patches immediately and perform a thorough audit of database access logs to ensure that no unauthorized data extraction has occurred.