
Proof-of-concept exploit for CVE-2026-78837, an unauthenticated SQL injection in AppNitro MachForm v30 allowing enumeration of database column names via crafted filter parameters.
An SQL injection vulnerability in the ap_form_{id} parameter in AppNitro MachForm v30 allows attackers to access sensitive database information via a crafted SQL statement.
Tested on MachForm - Version 30
Remote
An unauthenticated attacker can inject into the filter[filters][0][field] parameter in grid_datasource.php to enumerate valid column names in the ap_form_{id} table.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P (6.9 / Medium)
https://<application-baseurl>/grid_datasource.php?key={form_id}x{widget_key}&filter[filters][0][field]=element_1&filter[filters][0][operator]=contains&filter[filters][0][value]=%25
Nabeel Khan - NCCGroup