Fortinet warns of a critical SQL Injection vulnerability that could allow an unauthenticated attacker to execute arbitrary code on vulnerable FortiClientEMS software.

CVE-2023-48788: Critical Fortinet FortiClientEMS SQL Injection Vulnerability

A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiClientEMS version 7.2.0 through 7.2.2, FortiClientEMS 7.0.1 through 7.0.10 allows attacker to execute unauthorized code or commands via specially crafted packets.

Researchers observed attackers exploiting this flaw to install unauthorized remote management and monitoring tools and PowerShell backdoors. Patching is strongly advised.

Public proof-of-concept code has now been released with a detailed walkthrough. Organizations using FortiClientEMS are strongly encouraged to upgrade as soon as possible.

Fortinet confirmed in-the-wild exploitation for this flaw has been observed. Organizations using FortiClientEMS are strongly encouraged to upgrade as soon as possible.

With a public proof-of-concept due to be released next week for CVE-2023-48788, organizations using FortiClientEMS are strongly encouraged to upgrade as soon as possible.

Detections

Analytics

CVE-2023-48788

critical

Vulnerable Software