CVE-2026-96777: Forma LMS SQL Injection Vulnerability

CVE-2026-96777 Overview

CVE-2026-96777 is a SQL injection vulnerability in Forma LMS versions up to 4.1.43. The flaw resides in the UserselectorAdmController::getDataTask function within /appCore/ajax.adm_server.php?r=adm/userselector/getData, part of the Multi-User-Selector AJAX endpoint. Attackers can manipulate the Name argument to inject arbitrary SQL statements. The attack is executable remotely and requires low privileges. The exploit has been publicly disclosed, and the vendor did not respond to coordinated disclosure attempts. This weakness maps to [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact
Authenticated remote attackers can inject arbitrary SQL queries through the Name parameter, potentially exposing or altering user data stored in the Forma LMS database.

Affected Products

Forma LMS versions up to and including 4.1.43
Component: Multi-User-Selector AJAX Endpoint (/appCore/ajax.adm_server.php)
Function: UserselectorAdmController::getDataTask

Discovery Timeline

2026-09-24 - CVE-2026-96777 published to NVD
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-96777

Vulnerability Analysis

The vulnerability resides in the Forma LMS administrative AJAX handler responsible for returning user-selector data. The getDataTask method within UserselectorAdmController accepts the Name request parameter and incorporates it into a database query without proper sanitization or parameterization. An authenticated user with access to the admin AJAX endpoint can submit crafted input through the Name argument. The server concatenates the attacker-controlled string into a backend SQL statement, enabling arbitrary query manipulation.

The issue is reachable over the network and does not require user interaction. According to VulDB tracking, the proof-of-concept is publicly disclosed, and the vendor did not acknowledge the researcher's outreach.

Root Cause

The root cause is improper neutralization of user-supplied input before use in a SQL statement [CWE-74]. The Name parameter flows into a query construction routine that performs string concatenation rather than using prepared statements or parameterized queries. No input validation or escaping is applied to the parameter before it reaches the database driver.

Attack Vector

An attacker authenticated to the Forma LMS admin interface sends an HTTP request to /appCore/ajax.adm_server.php?r=adm/userselector/getData with a malicious payload in the Name parameter. The payload is appended to the backend SQL query, allowing data extraction via UNION-based or boolean-based injection techniques. The attack originates remotely over the network. No verified exploit code is provided in trusted sources beyond the public VulDB and advisory references listed below.

For technical details, see the GitHub FormalMS SQL Advisory Repository and VulDB CVE-2026-96777.

Detection Methods for CVE-2026-96777

Indicators of Compromise

HTTP requests to /appCore/ajax.adm_server.php?r=adm/userselector/getData containing SQL metacharacters (', --, UNION, SELECT, OR 1=1) in the Name parameter.
Unexpected spikes in query duration or database errors originating from the userselector endpoint.
Administrative session activity from unusual source IP addresses interacting with the Multi-User-Selector endpoint.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the Name query parameter for SQL injection signatures on the vulnerable endpoint.
Enable database query logging to flag unusual SELECT statements referencing user tables issued through the Forma LMS application account.
Correlate HTTP 500 responses from ajax.adm_server.php with downstream database errors to surface failed injection attempts.

Monitoring Recommendations

Monitor Forma LMS application logs for repeated requests to the user selector endpoint from a single authenticated session.
Alert on outbound data transfer anomalies from the LMS database server, which may indicate exfiltration via injection.
Review administrative role assignments and recent account creation events to detect post-exploitation activity.

How to Mitigate CVE-2026-96777

Immediate Actions Required

Restrict access to the Forma LMS administrative interface using IP allowlisting or VPN enforcement until a patch is available.
Audit all administrator and privileged accounts and reset credentials where suspicious activity is observed.
Deploy virtual patching through a WAF to block SQL injection payloads targeting the Name parameter on /appCore/ajax.adm_server.php.

Patch Information

No vendor patch is currently referenced in the available advisory data. The vendor was contacted but did not respond to the disclosure. Monitor the GitHub FormalMS Advisory Repository and the official Forma LMS release channels for updates beyond version 4.1.43.

Workarounds

Apply a reverse-proxy rule that drops requests to ajax.adm_server.php?r=adm/userselector/getData containing SQL metacharacters in the Name parameter.
Enforce least-privilege database accounts for the Forma LMS web application to limit the blast radius of any successful injection.
Disable or firewall the Multi-User-Selector functionality for environments that do not require administrative multi-user selection workflows.

bash

# Example NGINX rule to block SQL metacharacters in the vulnerable parameter
location /appCore/ajax.adm_server.php {
    if ($arg_Name ~* "(\'|--|union|select|or\s+1=1)") {
        return 403;
    }
}