CVE-2026-63234: Koollab LMS RCE Vulnerability

CVE-2026-63234 Overview

CVE-2026-63234 is a critical vulnerability in Koollab Learning Management System (LMS) that chains SQL injection [CWE-89] with unsafe deserialization. An authenticated attacker can inject through the manual mark assessment endpoint and control data passed to PHP's unserialize() function. Successful exploitation lets attackers write a webshell to a publicly accessible location and execute arbitrary code on the server. The flaw carries a CVSS 3.1 score of 9.9 and requires only low-privilege authentication over the network.

Critical Impact
Authenticated attackers can achieve remote code execution on Koollab LMS servers by chaining SQL injection with PHP object injection, resulting in full compromise of confidentiality, integrity, and availability.

Affected Products

Koollab LMS (manual mark assessment endpoint)

Discovery Timeline

2026-07-29 - CVE-2026-63234 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-63234

Vulnerability Analysis

The vulnerability chains two distinct weaknesses in the Koollab LMS manual mark assessment endpoint. An authenticated user with low privileges submits crafted input that reaches a SQL query without proper parameterization or sanitization. The attacker uses this injection primitive to influence data that is later passed to PHP's unserialize() function. Because the endpoint deserializes attacker-controlled input, arbitrary PHP objects can be instantiated and their magic methods triggered during object destruction or property access.

This PHP object injection primitive is leveraged to write arbitrary content to disk. Attackers place a webshell at a location served by the web root, then request the webshell over HTTP to execute arbitrary commands under the web server's user context. The scope change (S:C) in the CVSS vector reflects that compromise of the LMS process affects resources beyond its original authorization boundary.

Root Cause

The root cause is twofold. First, input handling for the manual mark assessment endpoint concatenates user-supplied data into SQL statements rather than using prepared statements, enabling SQL injection [CWE-89]. Second, the application deserializes data whose contents can be influenced by that same untrusted input, permitting object injection and gadget-chain execution.

Attack Vector

An attacker authenticates to Koollab LMS with any account that can access the manual mark assessment feature. The attacker submits crafted parameters to the endpoint containing SQL payloads that alter query results or write serialized PHP objects into records that are later retrieved and passed to unserialize(). When the crafted object is deserialized, its magic methods trigger a gadget chain that writes a PHP webshell to a web-accessible directory. The attacker then requests the webshell URL to execute arbitrary system commands.

No verified public proof-of-concept code is available. Refer to the CSA Security Advisory AL-2026-094 for additional technical detail.

Detection Methods for CVE-2026-63234

Indicators of Compromise

Unexpected .php files created under web-accessible directories of the Koollab LMS installation, particularly files created by the web server user outside normal deployment activity.
HTTP POST requests to the manual mark assessment endpoint containing SQL metacharacters, UNION SELECT clauses, or serialized PHP object markers such as O: and s:.
Web server processes spawning shell interpreters (sh, bash, cmd.exe) or reconnaissance binaries (whoami, id, uname).

Detection Strategies

Inspect application and database query logs for anomalous SQL syntax originating from the manual mark assessment endpoint.
Alert on serialized PHP payload signatures (O:\d+:", a:\d+:{) submitted to authenticated LMS endpoints.
Monitor file integrity on the LMS web root and flag creation of new executable files outside patch or deployment windows.

Monitoring Recommendations

Forward web server access logs, PHP error logs, and MySQL general query logs to a central data lake for correlation.
Track child processes of the PHP-FPM or web server process and alert on interpreter or network utility execution.
Baseline authenticated LMS request patterns and alert on volumetric or structural deviations against the assessment endpoint.

How to Mitigate CVE-2026-63234

Immediate Actions Required

Restrict network access to the Koollab LMS management interfaces and the manual mark assessment endpoint to trusted networks or via VPN.
Audit all accounts with grading or assessment privileges and disable or reset those that are unused or shared.
Search the LMS web root and upload directories for unauthorized .php files and remove any confirmed webshells.

Patch Information

Refer to the CSA Security Advisory AL-2026-094 for vendor-supplied patch information and fixed versions. Apply vendor updates as soon as they are available.

Workarounds

Place a web application firewall rule in front of the LMS to block requests containing serialized PHP object signatures or SQL metacharacters targeting the assessment endpoint.
Enforce least-privilege file system permissions so that the web server user cannot write into directories served over HTTP.
Disable or restrict the manual mark assessment feature until the patch is applied where operationally feasible.

bash

# Example: restrict write permissions on web-accessible directories
chown -R root:www-data /var/www/koollab/public
find /var/www/koollab/public -type d -exec chmod 755 {} \;
find /var/www/koollab/public -type f -exec chmod 644 {} \;

# Example: audit for unexpected PHP files created in the last 7 days
find /var/www/koollab -name '*.php' -mtime -7 -ls