EUVD-2025-209801
GHSA-6mf6-qrvj-29vm
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionNVD
An improper neutralization of special elements used in an SQL Command ("SQL Injection&") vulnerability [CWE-89] vulnerability in Fortinet FortiMail 7.6.0 through 7.6.3, FortiMail 7.4.0 through 7.4.5, FortiMail 7.2.0 through 7.2.8 allows an authenticated privileged attacker to execute unauthorized code or commands via specifically crafted HTTP or HTTPS requests.
AnalysisAI
SQL injection in FortiMail 7.2.0-7.2.8, 7.4.0-7.4.5, and 7.6.0-7.6.3 allows authenticated privileged administrators to execute arbitrary code or commands via crafted HTTP/HTTPS requests. The vulnerability requires high-privilege authentication (administrator role) and affects all recent major versions, with exploitation confirmed possible through network-accessible admin interfaces.
Technical ContextAI
FortiMail is Fortinet's email security gateway that processes mail traffic and administrative configurations via web-based interfaces. CWE-89 (SQL Injection) occurs when user-supplied input from HTTP/HTTPS requests is not properly sanitized before being incorporated into SQL queries executed against FortiMail's backend database. The vulnerability exists in the authenticated administrative interface, meaning the SQL injection payload must be delivered through a request authenticated as a privileged FortiMail administrator. The improper neutralization of special SQL command elements allows attackers to manipulate database queries, potentially extracting data, modifying records, or achieving remote code execution depending on database permissions and backend architecture.
RemediationAI
Upgrade immediately to patched versions: FortiMail 7.2.9 or later, FortiMail 7.4.6 or later, or FortiMail 7.6.4 or later, per Fortinet advisory FG-IR-26-132 (https://fortiguard.fortinet.com/psirt/FG-IR-26-132). If immediate upgrade is not feasible, implement compensating controls: restrict FortiMail admin interface access to a hardened jump host or VPN with multi-factor authentication; disable or severely limit administrator account creation and use role-based access control (RBAC) to grant only necessary privileges (e.g., read-only mail policy review rather than full configuration change); enable detailed audit logging of all administrative API calls and SQL queries, with real-time alerting for anomalies. These controls do not eliminate the vulnerability but significantly reduce exploitability by limiting who can reach the vulnerable interface and enabling rapid incident detection. Prioritize patching over workarounds given the availability of vendor fixes and the sensitivity of email gateway administrative access.
Share
External POC / Exploit Code
Leaving vuln.today