The vulnerability arises from a SQL injection flaw in the ap_form_{id} parameter of AppNitro MachForm version 3.0. An attacker who can supply a crafted value to this parameter can execute arbitrary SQL statements against the application's database, enabling unauthorized retrieval of sensitive data. The flaw represents an input validation weakness and could be leveraged to exfiltrate confidential information.

The affected product is AppNitro MachForm v30. No additional vendors or sub‑products are listed by the CNA data.

The exploitation requires the attacker to submit a web request that includes the ap_form_{id} parameter with a malicious payload. The EPSS score for this vulnerability is <1%, indicating a low probability of exploitation, and it is not listed in the CISA KEV catalog, suggesting no widely‑known public exploits at the time of this analysis. However, SQL injection is a high‑risk weakness that can lead to data breaches. Inferred from the description, the attack can be performed remotely via the web interface, potentially without authentication if the parameter is publicly accessible.