PT-2025-10781 · Forti · Fortisandbox+1
Published
2025-03-11
·
Updated
2025-03-12
·
CVE-2024-54026
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions:
FortiSandbox Cloud version 23.4
FortiSandbox versions 3.0.0 through 3.0.7
FortiSandbox versions 3.1.0 through 3.1.5
FortiSandbox versions 3.2.0 through 3.2.4
FortiSandbox versions 4.0.0 through 4.0.5
FortiSandbox versions 4.2.0 through 4.2.7
FortiSandbox versions 4.4.0 through 4.4.6
Description:
The issue is related to an improper neutralization of special elements used in an SQL command, also known as 'sql injection'. This allows an attacker to execute unauthorized code or commands via specifically crafted HTTP requests.
Recommendations:
For FortiSandbox Cloud version 23.4, update to a version that includes a fix for this issue.
For FortiSandbox versions 3.0.0 through 3.0.7, update to a version that includes a fix for this issue.
For FortiSandbox versions 3.1.0 through 3.1.5, update to a version that includes a fix for this issue.
For FortiSandbox versions 3.2.0 through 3.2.4, update to a version that includes a fix for this issue.
For FortiSandbox versions 4.0.0 through 4.0.5, update to a version that includes a fix for this issue.
For FortiSandbox versions 4.2.0 through 4.2.7, update to a version that includes a fix for this issue.
For FortiSandbox versions 4.4.0 through 4.4.6, update to a version that includes a fix for this issue.
As a temporary workaround, consider restricting access to the SQL command functionality until a patch is available.
Fix
SQL injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Fortisandbox
Fortisandbox Cloud