CyberCVE

CVE-2024-54026

An improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiSandbox 4.4.0 through 4.4.6, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions, Fort

Severity
Medium 4.1
CVSS 3.1
Exploited
Not listed
EPSS
0.004
35.0th percentile
Discovered by
Vendor
Vendor advisory field
Published
Mar 11, 2025
Assigned by fortinet

Description

An improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiSandbox 4.4.0 through 4.4.6, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions, FortiSandbox 3.2 all versions, FortiSandbox 3.1 all versions, FortiSandbox 3.0 all versions, FortiSandbox Cloud 24.1 allows attacker to execute unauthorized code or commands via specifically crafted HTTP requests.

Weakness: CWE-89

Affected products

Vendor Product Category Matched by
Fortinet FortiSandbox Threat Detection & Sandbox cna-assigner
Vendor-reported products (2)
  • Fortinet · FortiSandbox
  • Fortinet · FortiSandbox Cloud

Credit

Internally discovered and reported by Adham El karn of Fortinet Product Security team.

Vendor remediation

Upgrade to FortiSandbox version 5.0.1 or above Upgrade to FortiSandbox version 4.4.7 or above Fortinet remediated this issue in FortiSandbox Cloud version 24.2 (not released) and hence customers do not need to perform any action.

References

Something wrong here?