Fortinet FortiClientEMS SQL Injection Vulnerability Allowing Unauthorized Code Execution

A vulnerability allowing SQL injection has been identified in Fortinet FortiClientEMS versions 7.4.0 to 7.4.5, 7.2.0 to 7.2.12, and all versions of 7.0. This vulnerability arises from improper neutralization of special elements used in SQL commands, which may enable an authenticated attacker to execute arbitrary SQL queries on the database by sending crafted requests.

Impact

Exploitation of this vulnerability could lead to unauthorized execution of SQL commands, potentially allowing attackers to manipulate the database or execute additional malicious actions.

Remediation

Users of Fortinet FortiClientEMS 7.4 should upgrade to version 7.4.6 or above. Users of Fortinet FortiClientEMS 7.2 should upgrade to version 7.2.13 or above. Users of Fortinet FortiClientEMS 7.0 should migrate to a fixed release.