SQL Injection and Unsafe Deserialization in LMS Assessment

A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the assessment overall answer endpoint, control data passed to unserialize(), write a webshell to a publicly accessible location, and execute arbitrary code on the server.

Casky was already ahead

This CVE exploits attack patterns that Casky's 322matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

This critical vulnerability (CVSS 9.9) in Koollab LMS combines two dangerous flaws: SQL injection through the assessment answer endpoint and unsafe deserialization of untrusted data. An authenticated attacker can exploit these weaknesses to inject malicious SQL queries, manipulate application logic, deserialize arbitrary objects that execute code, and ultimately write webshells to publicly accessible directories for persistent remote code execution. Organizations deploying Koollab LMS for course management and assessments face immediate risk of complete server compromise, data exfiltration, and lateral movement within their infrastructure.

Casky's 322 mapped skills detect the attack patterns underlying this CVE by correlating MITRE ATT&CK techniques TA0001 (Reconnaissance) and TA0043 (Reconnaissance via endpoint enumeration) with CWE-89 SQL injection signatures. Practitioners using Casky's Claude-powered analysis would identify: (1) suspicious SQL syntax patterns and timing variations in assessment submissions indicating injection attempts, (2) anomalous deserialization activities triggering object instantiation outside normal application flow, (3) file write operations to web-accessible paths like webroot directories, and (4) POST requests to the assessment endpoint with encoding anomalies suggesting payload obfuscation. The platform's extended reasoning capability correlates these discrete signals into a coherent attack chain, enabling security teams to distinguish genuine assessment data from exploitation attempts and prioritize remediation of authentication bypass and code execution risks.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

322 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-63233.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-63233

Casky has 322 skills that investigate the attack patterns behind CVE-2026-63233. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn