Pre-Authentication SQL Injection in LMS SCORM Reporting

A pre-authentication error-based SQL injection vulnerability in Koollab LMS allowed an unauthenticated attacker to read sensitive database contents, including personally identifiable information, credentials, and valid JWT tokens that may enable account takeover, via the SCORM report endpoint.

Casky was already ahead

This CVE exploits attack patterns that Casky's 322matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

This vulnerability represents a critical pre-authentication SQL injection flaw in Koollab LMS that allows unauthenticated attackers to extract sensitive data directly from the database. By exploiting the SCORM report endpoint, attackers bypass authentication entirely and gain access to personally identifiable information, stored credentials, and valid JWT tokens—the latter being particularly dangerous as it enables immediate account takeover. The attack requires no special privileges or user interaction, making it trivial to exploit at scale. Educational institutions and any organization deploying Koollab LMS are at immediate risk of data breach and unauthorized account compromise.

Casky's 322 matching skills leverage Claude AI's extended reasoning to detect the attack patterns embedded in CVE-2026-63230 by mapping exploitation techniques to MITRE ATT&CK's Initial Access (TA0001) and Persistence (TA0043) tactics. Practitioners using the platform would observe findings related to reconnaissance activities targeting unauthenticated endpoints, followed by detection of SQL injection payloads in SCORM report parameters. The skills would flag CWE-89 patterns—specifically unsanitized user input flowing into database queries—and alert on suspicious database queries accessing credential and token tables without proper authentication context. Security teams would see evidence of data exfiltration attempts and JWT token extraction, enabling them to identify compromised credentials and revoke tokens before account takeover occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

322 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-63230.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-63230

Casky has 322 skills that investigate the attack patterns behind CVE-2026-63230. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn