Vulnerability Spotlight: SQL injection vulnerabilities in Forma Learning Management System
Summary: Cisco Talos discovered three SQL injection vulnerabilities in the authenticated portion of Forma LMS 2.2.1, found by Yuri Kramarz of Security Advisory EMEAR. Specially crafted web requests with parameters containing SQL injection attacks can trigger the flaws, potentially allowing exfiltration of the database, user credentials and, in certain configurations, access to the underlying operating system.
What's compelling: The vulnerable code sits behind authentication, so an attacker who already holds a valid account on the training platform can use it to pull the database and user credentials, and in some configurations reach the operating system itself.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2019-5109CVE-2019-5110
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026