PT-2024-2112 · Fortinet · Forticlientems

Published 2024-03-12 · Updated 2026-02-18 · CVE-2023-48788

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Fortinet FortiClientEMS versions 7.0.1 through 7.0.10 Fortinet FortiClientEMS versions 7.2.0 through 7.2.2

Description The issue is related to an improper neutralization of special elements used in an SQL command, also known as a SQL injection vulnerability. This vulnerability allows an attacker to execute unauthorized code or commands via specially crafted packets. The vulnerability is being actively exploited in the wild, with attackers using it to install remote desktop tools like AnyDesk and ScreenConnect, and to deploy ransomware. The estimated number of potentially affected devices worldwide is not specified, but it is known that over 440 vulnerable FortiClient EMS servers have been found on the internet, with the majority located in the US.

Recommendations Fortinet FortiClientEMS versions 7.0.1 through 7.0.10: Update to a patched version to prevent exploitation of the SQL injection vulnerability. Fortinet FortiClientEMS versions 7.2.0 through 7.2.2: Update to a patched version to prevent exploitation of the SQL injection vulnerability. As a temporary workaround, consider disabling any unnecessary SQL commands or restricting access to the FortiClient EMS software until a patch is available.

Exploit

Fix

RCE

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2024-02008

CVE-2023-48788

Affected Products

Forticlientems

References · 262

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/forticlient_ems_fctid_sqli.rb · Exploit
• 🔥 https://github.com/horizon3ai/CVE-2023-48788 · Exploit
• 🔥❌ https://github.com/CVETechnologic/CVE-2023-48788-Proof-of-concept-SQLinj · Exploit, Deleted
• 🔥❌ https://github.com/mrobsidian1/CVE-2023-48788-Proof-of-concept-SQLinj · Exploit, Deleted
• https://osv.dev/vulnerability/CVE-2023-48788 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-48788 · Security Note
• https://bdu.fstec.ru/vul/2024-02008 · Security Note
• https://twitter.com/ohhara_shiojiri/status/1837018634037936272 · Twitter Post
• https://twitter.com/a0xnirudh/status/1771266638081347917 · Twitter Post
• https://twitter.com/Horizon3ai/status/1773734616400056744 · Twitter Post
• https://twitter.com/buaqbot/status/1800344862153175410 · Twitter Post
• https://twitter.com/the_yellow_fall/status/1772166822810530281 · Twitter Post
• https://twitter.com/HunterMapping/status/1772087795370147842 · Twitter Post
• https://reddit.com/r/CVEWatch/comments/1luks93/top_10_trending_cves_08072025 · Reddit Post
• https://twitter.com/TrueFort/status/1772992100017033237 · Twitter Post