Description
A post-authentication SQL injection
vulnerability in Koollab LMS allowed an authenticated attacker to use an error-based SQL oracle via
the face-to-face runs update endpoint to read the entire application database
and obtain valid JWT tokens for account takeover.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Three Learning | Koollab LMS | 5.3.2 | — |