Description
A SQL injection and unsafe deserialisation
vulnerability in Koollab LMS allowed an authenticated attacker to inject through the manual mark
assessment endpoint, control data passed to unserialize(), write a webshell to
a publicly accessible location, and execute arbitrary code on the server.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Three Learning | Koollab LMS | 5.3.2 | — |