Executive brief
MachForm is a web-based form builder and management platform used by businesses to create and deploy online forms. An unauthenticated attacker can inject malicious JavaScript into form requests, allowing them to steal session cookies, perform actions on behalf of victims, or redirect users to phishing pages when they click a crafted link.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in the grid_datasource.php component due to insufficient input validation on the filter[filters][0][field] parameter. The vulnerability is triggered when an unauthenticated attacker crafts a malicious URL containing JavaScript payload, which is reflected in the response without proper sanitization. The attack requires no authentication and relies on user interaction (victim clicking the link), and allows arbitrary JavaScript execution in the victim's browser context. The fix involves proper output encoding and input validation on the vulnerable parameter.
Affected products
- AppNitro MachForm v30
Timeline
- 2026-09-08: disclosed