A SQL injection and unsafe deserialisation
vulnerability in Koollab LMS allowed an authenticated attacker to inject through the manual mark
assessment endpoint,…

A critical vulnerability (CVE-2026-63234) was identified in Koollab LMS involving SQL injection combined with unsafe deserialization. An authenticated attacker can exploit the manual mark assessment endpoint to inject malicious SQL. The attacker can control data passed to PHP's unserialize() function, enabling object injection attacks. This chain of vulnerabilities allows writing a webshell to a publicly accessible server location. Once the webshell is deployed, the attacker can execute arbitrary code on the server. The vulnerability requires authentication but the impact is severe, enabling full server compromise. Both NVD and Singapore's CSA have published advisories regarding this issue.