CVE-2023-48788 Fortinet FortiClient EMS SQL Injection

What is CVE-2023-48788?

CVE-2023-48788 is a critical SQL injection vulnerability in Fortinet FortiClientEMS, published on 12 Mar 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiClientEMS version 7.2.0 through 7.2.2, FortiClientEMS 7.0.1 through 7.0.10 allows attacker to execute unauthorized code or commands via specially crafted packets.

Weakness: CWE-89

Which versions are affected by CVE-2023-48788?

It affects 1 product.

Products include Fortinet Forticlient Enterprise Management Server.

How do I fix CVE-2023-48788?

No fix has been published for CVE-2023-48788 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 15 Apr 2024.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2023-48788 being exploited?

Yes. Attackers have exploited CVE-2023-48788 in the wild since at least 25 Mar 2024, including in ransomware campaigns.

Public exploit code: 1 Metasploit module, 1 Nuclei template and 1 proofs of concept on GitHub.

Other vulnerabilities in Fortinet FortiClientEMS

• CVE-2023-45581 Privilege escalation in FortiClientEMS High 7.9
• CVE-2024-33508 Command injection in FortiClientEMS Medium 6.9
• CVE-2021-36189 Information disclosure in Fortinet FortiClientEMS Medium 6.8
• CVE-2021-41030 Auth bypass in Fortinet FortiClientEMS Medium 5.4
• CVE-2020-15940 Cross-site scripting in Fortinet FortiClientEMS Medium 4.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-fv47-jg3j-5qf6.