CVE-2023-48788
CRITICAL KEV RANSOMWARE NUCLEIFortinet Forticlient Endpoint Management Server - SQL Injection
Title source: nucleiExploitation Summary
CVE-2023-48788 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added March 25, 2024, with confirmed use in ransomware campaigns.
EIP tracks 2 public exploits from researchers including horizon3ai, Zach Hanley, James Horseman, jheysel-r7, Spencer McIntyre, including a Metasploit module exploits/windows/http/forticlient_ems_fctid_sqli.
A Nuclei detection template is also available.
AI-analyzed exploit summary This repository contains a functional Python exploit for CVE-2023-48788, a SQL injection vulnerability in Fortinet FortiClient EMS. The exploit sends a crafted registration message with a SQL injection payload to check for vulnerability.
Description
A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiClientEMS version 7.2.0 through 7.2.2, FortiClientEMS 7.0.1 through 7.0.10 allows attacker to execute unauthorized code or commands via specially crafted packets.
Exploits (2)
This repository contains a functional Python exploit for CVE-2023-48788, a SQL injection vulnerability in Fortinet FortiClient EMS. The exploit sends a crafted registration message with a SQL injection payload to check for vulnerability.
This Metasploit module exploits an SQL injection vulnerability (CVE-2023-48788) in FortiClient EMS, enabling unauthenticated remote code execution via xp_cmdshell in the context of NT AUTHORITY\SYSTEM. The exploit targets versions 7.2.0-7.2.2 and 7.0.1-7.0.10 by crafting malicious messages to the FCTDas.exe service.
Nuclei Templates (1)
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H