CVE-2026-96777 in LMS
Summary
by MITRE • 09/24/2026
A vulnerability was determined in Forma LMS up to 4.1.43. This impacts the function UserselectorAdmController::getDataTask of the file /appCore/ajax.adm_server.php?r=adm/userselector/getData of the component Multi-User-Selector AJAX Endpoint. This manipulation of the argument Name causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/24/2026
The Forma Learning Management System, a platform widely used for educational content delivery and user management, contains a critical security flaw within its administrative interface components. Specifically, the vulnerability resides in the UserselectorAdmController::getDataTask function located in the file /appCore/ajax.adm_server.php?r=adm/userselector/getData. This endpoint serves as an AJAX handler designed to retrieve data for multi-user selection interfaces, which are commonly utilized by administrators when assigning tasks or managing user permissions across various modules of the LMS. The core issue stems from improper input validation and sanitization mechanisms applied to the Name argument passed through this specific API call. Because the application fails to adequately filter special characters associated with SQL syntax before incorporating them into database queries, it creates a direct pathway for attackers to inject malicious code.
This vulnerability is classified as an SQL Injection flaw, which corresponds directly to CWE-89 in the Common Weakness Enumeration standard. The technical nature of this defect allows remote unauthenticated or authenticated users, depending on the specific access controls surrounding the endpoint, to manipulate backend database queries. By crafting a specially crafted HTTP request with malicious payloads embedded within the Name parameter, an attacker can bypass intended logic, extract sensitive data such as user credentials and personal information, modify existing records, or potentially execute administrative commands if the underlying database service permissions are overly permissive. The fact that this vulnerability has been publicly disclosed indicates that proof-of-concept exploits exist in the wild, significantly increasing the risk of automated attacks against systems running Forma LMS versions up to 4.1.43.
From an operational perspective, the impact of this SQL injection is severe and multifaceted. Attackers can leverage this flaw to perform data exfiltration, compromising the confidentiality of student records, instructor details, and administrative logs. Furthermore, depending on the database engine version and configuration, techniques such as blind SQL injection or time-based extraction could allow for complete database takeover. This aligns with several tactics in the MITRE ATT&CK framework, particularly T1059 Command and Scripting Interpreter if command execution is achieved via stacked queries, and T1078 Valid Accounts if the attacker uses extracted credentials to maintain persistent access. The lack of response from the vendor since early contact suggests that organizations running this software are currently exposed without official patches or guidance for remediation, necessitating immediate proactive measures by system administrators.
Mitigation strategies must focus on both technical controls and procedural updates until a patched version is available. Immediate steps should include restricting network access to the /appCore/ajax.adm_server.php endpoint, ensuring it is only reachable from trusted administrative IP ranges via firewall rules or reverse proxy configurations. Implementing Web Application Firewall signatures that detect common SQL injection patterns in AJAX requests can provide an additional layer of defense. Developers and administrators must also audit database user privileges for the application to ensure least privilege principles are enforced, limiting potential damage even if exploitation occurs. Long-term resolution requires upgrading to a version where this vulnerability has been patched or migrating to a supported learning management system that adheres to secure coding standards such as OWASP Top Ten guidelines regarding input validation and parameterized queries.