Fortinet FortiPortal SQL Injection Vulnerability Allowing Query Disclosure

A SQL injection vulnerability has been identified in Fortinet FortiPortal versions 7.2.4 through 7.2.0 and 7.0.0 through 7.2.8. This vulnerability arises from improper neutralization of special elements used in SQL commands, which may allow an authenticated attacker to view SQL queries being executed on the server side. The issue can be exploited by including special elements in an HTTP request.

Impact

Exploitation of this vulnerability could lead to unauthorized disclosure of SQL queries being executed on the server, potentially allowing attackers to infer sensitive database information or manipulate database queries.