AppNitro MachForm 30 SQL Injection

# CVE-2026-78837
    
    ## Description
    An SQL injection vulnerability in the `ap_form_{id}` parameter in AppNitro MachForm v30 allows attackers to access sensitive database information via a crafted SQL statement.
    
    ## Affected Component
    Tested on MachForm - Version 30
    
    ## Attack Type
    Remote
    
    ## Attack Vectors
    An unauthenticated attacker can inject into the `filter[filters][0][field]` parameter in `grid_datasource.php` to enumerate valid column names in the `ap_form_{id}` table.
    
    ## Risk
    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P (6.9 / Medium)
    
    ## Reference
    `https://<application-baseurl>/grid_datasource.php?key={form_id}x{widget_key}&filter[filters][0][field]=element_1&filter[filters][0][operator]=contains&filter[filters][0][value]=%25`
    
    ## Researcher
    Nabeel Khan - NCCGroup