SQL Injection and Unsafe Deserialization in Koollab LMS

A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the manual mark assessment endpoint, control data passed to unserialize(), write a webshell to a publicly accessible location, and execute arbitrary code on the server.

Casky was already ahead

This CVE exploits attack patterns that Casky's 322matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

This critical vulnerability (CVSS 9.9) combines SQL injection with unsafe object deserialization in Koollab LMS's manual mark assessment endpoint. An authenticated attacker can exploit SQL injection to manipulate database queries, then leverage unsafe deserialization to instantiate arbitrary PHP objects that write a webshell to publicly accessible directories. This enables unauthenticated remote code execution on the server. Any organization deploying Koollab LMS for student assessment is at risk, as the vulnerability requires only valid user credentials to trigger—a relatively low barrier for attackers with internal access or compromised accounts.

Casky's 322 matching security skills leverage Claude's extended reasoning to detect the attack chain across MITRE ATT&CK's Initial Access (TA0001) and Execution (TA0043) tactics. Practitioners would see skill-driven detections identifying: (1) anomalous SQL patterns in assessment endpoints showing injection syntax, (2) deserialization calls processing untrusted user input, (3) file write operations to web-accessible directories with suspicious file extensions (.php, .phtml), and (4) unusual process spawning or reverse shell indicators following webshell deployment. The platform correlates these signals across the attack lifecycle, helping teams distinguish legitimate assessment activity from exploitation attempts and prioritize rapid response to this high-severity threat vector.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

322 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-63234.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-63234

Casky has 322 skills that investigate the attack patterns behind CVE-2026-63234. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn