How can I convince the university to apply security upgrades to the online learning system?
How can you convince the higher authorities that security holes are a risk? Read up on the vulnerabilities and send them a list of concrete examples. No "an attacker could gain access to the database", but "someone could hack in and change all the passwords, and on the internet you can find a script to do this [link]". Your word may not carry much weight, so try to get the tech guys to sign it too.

Another option is to find a security expert at the CS department. They should be able to put a stronger, more authoritative word.

Of course, do not attack the server yourself, even if you don't change anything. That is more likely to upset people and backfire. But you could suggest the tech support to do it themselves as proof.