An authenticated remote code execution vulnerability in Three Learning Koollab LMS allows attackers to gain full system control through unsafe deserialization and SQL injection.

The assessment reinforcement endpoint fails to properly validate input, permitting an authenticated attacker to inject SQL commands and manipulate data passed to an insecure deserialization function. This sequence enables the attacker to write a webshell to the server and execute arbitrary code.

The ability to execute arbitrary code on the server constitutes a total compromise of the application and its underlying host. With a CVSS score of 9.9, this vulnerability poses a severe threat to data integrity, confidentiality, and availability, potentially allowing attackers to pivot into the broader network environment.

Immediate Action: Update Three Learning Koollab LMS to the latest available version to address the deserialization and injection flaws.

Proactive Monitoring: Monitor server file system integrity for the creation of unexpected files and review web logs for access to suspicious scripts or webshells.

Compensating Controls: Restrict access to the assessment reinforcement endpoint and utilize file integrity monitoring tools to detect unauthorized changes to the web root.

Public Exploit Available: No

This is a critical vulnerability that enables full remote code execution. Organizations should prioritize updating their LMS instance immediately and verify that no unauthorized accounts are being used to probe or exploit these specific endpoints.