SQL Injection and Unsafe Deserialization in Koollab LMS

A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the assessment reinforcement endpoint, control data passed to unserialize(), write a webshell to a publicly accessible location, and execute arbitrary code on the server.

Casky was already ahead

This CVE exploits attack patterns that Casky's 322matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

This critical vulnerability (CVSS 9.9) affects Koollab LMS and combines two dangerous attack vectors: SQL injection through the assessment reinforcement endpoint and unsafe object deserialization. Authenticated attackers can exploit this flaw to inject malicious SQL, manipulate data passed to unserialize() functions, write webshells to publicly accessible directories, and ultimately achieve remote code execution on the server. Organizations deploying Koollab LMS are directly impacted, particularly educational institutions and training platforms that rely on this learning management system. The authenticated nature of the attack reduces the immediate external threat surface but represents severe insider risk and post-compromise escalation scenarios.

Casky's 322 matching security skills leverage Claude's extended reasoning to map attack patterns across both MITRE ATT&CK techniques involved: Initial Access (TA0001) through authenticated session abuse, and Execution (TA0043) through code injection and deserialization gadget chains. Practitioners using Casky would observe detection findings that correlate SQL injection attempts to the assessment reinforcement endpoint (CWE-89 indicator), followed by unserialize() call monitoring and webshell artifact signatures in web-accessible directories. The platform's skills would flag the progression from data manipulation to arbitrary code execution, highlighting the critical control failure: insufficient input validation on SQL queries combined with dangerous deserialization of untrusted data. This multi-stage pattern recognition helps practitioners understand not just that an attack occurred, but the precise technique chain that transforms authentication bypass into full server compromise.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

322 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-63232.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-63232

Casky has 322 skills that investigate the attack patterns behind CVE-2026-63232. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn