Forma LMS is vulnerable to an authenticated SQL injection attack that allows remote attackers to manipulate backend database queries, posing a significant risk to data integrity and confidentiality.

This vulnerability is a SQL injection flaw (CWE-89) located in the UserselectorAdmController::getDataTask function. Any authenticated user, regardless of administrative privileges, can provide a malicious identifier in the columns[i][name] parameter to bypass sanitization and inject arbitrary SQL commands.

The ability to perform SQL injection against the application database can lead to unauthorized data exfiltration, modification of user records, or total compromise of the LMS database. Given the CVSS score of 6.3, this vulnerability represents a significant risk to organizational data, potentially leading to unauthorized access to sensitive student or organizational information.

Immediate Action: As no patch is currently confirmed, administrators should restrict access to the affected endpoint or limit the ability of low-privileged users to interact with administrative AJAX functions.

Proactive Monitoring: Monitor database logs for unusual query patterns, specifically those containing SQL syntax characters, SLEEP commands, or unexpected identifier structures originating from the /appCore/ajax.adm_server.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to inspect POST parameters for SQL injection signatures, specifically targeting the DataTables server-side format parameters.

Public Exploit Available: Yes, a proof-of-concept exists as documented in the researcher's technical write-up on GitHub.

The severity of this flaw is elevated by the ease of exploitation and the lack of a vendor-provided fix. Organizations using Forma LMS should immediately audit user permissions to ensure that non-administrative accounts cannot reach the vulnerable AJAX endpoints. Maintain heightened vigilance and monitor for vendor updates, as the vulnerability is confirmed to bypass existing input filtering mechanisms.