External risk intelligence

Koollab LMS SQL Injection Allows Pre-Authentication Database Read and Account Takeover

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-63230

The vulnerability resides in a Learning Management System (LMS) specifically within a SCORM report endpoint accessible without authentication. LMS platforms are typically designed to be web-facing to serve users, and pre-authentication endpoints are inherently exposed to the public internet.

SQL Injection

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability in Koollab Learning Management System (LMS) has been identified, allowing unauthenticated attackers to access sensitive database information. This could potentially lead to the compromise of user accounts by exposing personally identifiable information, credentials, and authentication tokens.

Attackers can steal user data and credentials.
Critical data exposure risks account takeover.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending a specially crafted request to the SCORM report endpoint of the Koollab LMS. Because no authentication is required, an unauthenticated attacker can target this endpoint to query the database. If successful, the attacker can gain access to sensitive information.

No authentication required.
SCORM report endpoint.
Read sensitive database contents.

Live Threat

Current exploitation, exposure, and threat context

A pre-authentication SQL injection vulnerability in the Koollab LMS could allow an unauthenticated attacker to access sensitive database information. This could include personally identifiable information, user credentials, and valid JSON Web Tokens, potentially leading to account takeover when interacting with the SCORM report endpoint.

Sensitive database contents.
Via an unauthenticated SCORM report endpoint.
Potential account takeover.

Operational Fix

Recommended remediation, mitigation, and detection steps

Determine ownership of the Koollab LMS and its SCORM report endpoint to assess exposure and plan remediation. Initial steps include identifying all instances of the LMS, confirming external reachability, and locating the accountable system owner to prioritize remediation efforts based on business criticality and potential impact from data exfiltration or account takeover.

Application owners should own the issue.
Verify external reachability and critical assets first.
Plan remediation and vendor coordination next.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Koollab LMS?

Koollab LMS is a Learning Management System designed to manage educational content, track student progress, and store user data. It often relies on standardized formats like SCORM to ensure courses work across different systems, making it a central repository for institutional and personal learning information.

What does SQL injection mean for CVE-2026-63230?

SQL injection is a weakness where an application improperly handles user input, allowing an attacker to insert their own commands into database queries. In this CVE, the vulnerability allows unauthorized parties to manipulate those queries to view sensitive data that should be protected.

How is the SCORM report endpoint triggered?

An attacker triggers this vulnerability by sending a specifically formatted request to the SCORM report endpoint. Because the endpoint does not require a valid login, it can be accessed by anyone with network reach to the system. Normal user interactions with legitimate SCORM reports through the intended web interface do not trigger this flaw.

Is my Koollab LMS instance at high risk?

Halo Surface Signal indicates a high risk because LMS platforms are typically web-facing to allow remote student access. Since this flaw does not require a login, any instance reachable via the public internet is susceptible to immediate interaction by an outside attacker.

What are the first steps for administrators?

Start by identifying all instances of Koollab LMS running in your environment. Prioritize those that are accessible from the internet, as they are the most vulnerable. Locate the system owners to coordinate a review of the application and prepare for official updates or patches from the vendor.

References

www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-094/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.