Blind SQL Injection

Summary

An improper neutralization of special elements used in a SQL Command [CWE-89] in FortiPortal may allow a priviledged user to obtain unauthorized information via the report download functionality.

Acknowledgement

Fortinet is pleased to thank David Cmara Galindo and Jose Catalan Tatay from Telefonica Tech for bringing this issue to our attention under responsible disclosure.

Timeline

2024-06-11: Initial publication