An authenticated remote code execution vulnerability in Three Learning Koollab LMS allows attackers to gain full system control through unsafe deserialization and SQL injection.

The assessment overall answer endpoint lacks necessary input validation, allowing an authenticated attacker to perform SQL injection and manipulate data processed by an insecure deserialization function. This allows the attacker to place a webshell on the server and execute arbitrary commands.

Exploitation of this vulnerability allows an attacker to gain complete control over the server hosting the LMS. Given the CVSS score of 9.9, this represents a critical risk that could lead to the theft of student or administrative data, service disruption, and unauthorized persistence within the corporate network.

Immediate Action: Update Three Learning Koollab LMS to the latest available version to patch the identified deserialization and injection vectors.

Proactive Monitoring: Monitor server logs for unauthorized modifications and perform regular scans for the presence of malicious scripts or webshells.

Compensating Controls: Implement strict input validation or WAF rules to block malicious payloads targeting deserialization functions and SQL endpoints.

Public Exploit Available: No

The vulnerability is critical and provides a direct path to server compromise. It is imperative that administrators update the software immediately and audit all user accounts to ensure no compromised credentials are being leveraged to exploit these vulnerabilities.