CVE-2024-54026: error based SQLI on device del feature
An improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiSandbox 4.4.0 through 4.4.6, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions, FortiSandbox 3.2 all versions, FortiSandbox 3.1 all versions, FortiSandbox 3.0 all versions, FortiSandbox Cloud 24.1 allows attacker to execute unauthorized code or commands via specifically crafted HTTP requests.
Other sources
An improper neutralization of special elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] in FortiSandbox may allow a privileged attacker to execute unauthorized code or commands via specifically crafted HTTP requests.
— FortiGuard
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2024-54026?
CVE-2024-54026 is categorized as a critical severity SQL injection vulnerability affecting multiple versions of Fortinet FortiSandbox.
How do I fix CVE-2024-54026?
To mitigate CVE-2024-54026, upgrade to Fortinet FortiSandbox version 4.4.7 or later.
Which versions of Fortinet FortiSandbox are affected by CVE-2024-54026?
CVE-2024-54026 affects Fortinet FortiSandbox Cloud 23.4 and multiple FortiSandbox versions including 4.4.0 to 4.4.6, 4.2.0 to 4.2.7, 4.0.0 to 4.0.5, and earlier versions.
What type of vulnerability is CVE-2024-54026?
CVE-2024-54026 is an SQL injection vulnerability that involves improper neutralization of special elements used in an SQL command.
What are the potential impacts of CVE-2024-54026?
Exploitation of CVE-2024-54026 could allow an attacker to execute arbitrary SQL commands on the database, leading to unauthorized data access or manipulation.