This vulnerability in Forma LMS up to version 4.1.43 allows remote attackers to exploit a SQL injection flaw in the UserselectorAdmController::getDataTask function within the Multi-User-Selector AJAX Endpoint. By manipulating the 'Name' parameter in the /appCore/ajax.adm_server.php?r=adm/userselector/getData request, an attacker can inject SQL commands. The vulnerability has been publicly disclosed, but the vendor has not issued any response or patch. The CVSS 4.0 base score is 5.3, indicating medium severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database of the affected Forma LMS installations. This may lead to unauthorized data access or modification. However, the impact is rated medium based on the CVSS score, reflecting limited scope or complexity of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should monitor official channels for updates. In the meantime, restricting access to the vulnerable endpoint and applying web application firewall (WAF) rules to detect and block SQL injection attempts may reduce risk.