Fortinet FortiAnalyzer, FortiManager, and FortiAnalyzer-BigData SQL Injection Vulnerability Allowing Unauthorized Code Execution

A SQL injection vulnerability has been identified in Fortinet FortiAnalyzer versions 7.4.0 through 7.4.2 and prior to 7.2.5, as well as in FortiManager versions 7.4.0 through 7.4.2 and prior to 7.2.5. Fortinet FortiAnalyzer-BigData version 7.4.0 and prior to 7.2.7 are also affected. This vulnerability arises from improper neutralization of special elements used in SQL commands, allowing a privileged attacker to execute unauthorized code or commands by sending specially crafted CLI requests.

Impact

Exploitation of this vulnerability allows for unauthorized code execution or command execution on the affected system.