PSIRTUnauthenticated SQL Injection Vulnerability
Summary
An improper neutralization of special elements used in an sql command [CWE-89] in FortiWLM may allow a remote unauthenticated attacker to execute unauthorized sql queries via a crafted http request.
| Version | Affected | Solution |
|---|---|---|
| FortiWLM 8.6 | 8.6.0 through 8.6.5 | Upgrade to 8.6.6 or above |
| FortiWLM 8.5 | 8.5.0 through 8.5.4 | Upgrade to 8.5.5 or above |
| FortiWLM 8.4 | 8.4 all versions | Migrate to a fixed release |
| FortiWLM 8.3 | 8.3 all versions | Migrate to a fixed release |
| FortiWLM 8.2 | 8.2 all versions | Migrate to a fixed release |
Acknowledgement
Fortinet is pleased to thank security researchers Zach Hanley (@hacks_zach) of Horizon3.ai for discovering and reporting this vulnerability under responsible disclosure.Timeline
2023-11-06: Initial publication