Description
A pre-authentication blind SQL injection
vulnerability in Koollab LMS allowed an unauthenticated attacker to use a time-based SQL oracle via
the SSO OAuth endpoint to read sensitive database contents, including
personally identifiable information, credentials, and valid JWT tokens that may
enable account takeover.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Three Learning | Koollab LMS | 5.3.2 | — |