Description
An improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiSandbox 4.4.0 through 4.4.6, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions, FortiSandbox 3.2 all versions, FortiSandbox 3.1 all versions, FortiSandbox 3.0 all versions, FortiSandbox Cloud 24.1 allows attacker to execute unauthorized code or commands via specifically crafted HTTP requests.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Fortinet | FortiSandbox | 4.4.0 – ≤ 4.4.6, 4.2.1 – ≤ 4.2.8, 4.0.0 – ≤ 4.0.6, 3.2.0 – ≤ 3.2.4, 3.1.0 – ≤ 3.1.5, 3.0.0 – ≤ 3.0.7 | — |
| Fortinet | FortiSandbox Cloud | 24.1 | — |
Advisories 2
- NCSC-2025-0083 Kwetsbaarheden verholpen in Fortinet FortiSandbox NCSC-NL (Netherlands) · Mar 12, 2025
- WID-SEC-2025-0531 Fortinet FortiSandbox: Mehrere Schwachstellen BSI CERT-Bund (WID) · Mar 11, 2025