EUVD-2025-209801
GHSA-6mf6-qrvj-29vm
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
An improper neutralization of special elements used in an SQL Command ("SQL Injection&") vulnerability [CWE-89] vulnerability in Fortinet FortiMail 7.6.0 through 7.6.3, FortiMail 7.4.0 through 7.4.5, FortiMail 7.2.0 through 7.2.8 allows an authenticated privileged attacker to execute unauthorized code or commands via specifically crafted HTTP or HTTPS requests.
AnalysisAI
SQL injection in FortiMail 7.2.0-7.2.8, 7.4.0-7.4.5, and 7.6.0-7.6.3 allows authenticated privileged administrators to execute arbitrary code or commands via crafted HTTP/HTTPS requests. The vulnerability requires high-privilege authentication (administrator role) and affects all recent major versions, with exploitation confirmed possible through network-accessible admin interfaces.
Technical ContextAI
FortiMail is Fortinet's email security gateway that processes mail traffic and administrative configurations via web-based interfaces. CWE-89 (SQL Injection) occurs when user-supplied input from HTTP/HTTPS requests is not properly sanitized before being incorporated into SQL queries executed against FortiMail's backend database. The vulnerability exists in the authenticated administrative interface, meaning the SQL injection payload must be delivered through a request authenticated as a privileged FortiMail administrator. The improper neutralization of special SQL command elements allows attackers to manipulate database queries, potentially extracting data, modifying records, or achieving remote code execution depending on database permissions and backend architecture.
RemediationAI
Upgrade immediately to patched versions: FortiMail 7.2.9 or later, FortiMail 7.4.6 or later, or FortiMail 7.6.4 or later, per Fortinet advisory FG-IR-26-132 (https://fortiguard.fortinet.com/psirt/FG-IR-26-132). If immediate upgrade is not feasible, implement compensating controls: restrict FortiMail admin interface access to a hardened jump host or VPN with multi-factor authentication; disable or severely limit administrator account creation and use role-based access control (RBAC) to grant only necessary privileges (e.g., read-only mail policy review rather than full configuration change); enable detailed audit logging of all administrative API calls and SQL queries, with real-time alerting for anomalies. These controls do not eliminate the vulnerability but significantly reduce exploitability by limiting who can reach the vulnerable interface and enabling rapid incident detection. Prioritize patching over workarounds given the availability of vendor fixes and the sensitivity of email gateway administrative access.
Fortinet FortiWeb contains a relative path traversal allowing unauthenticated attackers to execute administrative comman
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Fortinet FortiWeb contains an authenticated OS command injection allowing privilege escalation to execute unauthorized c
Fortinet FortiAnalyzer before 5.0.12 and 5.2.x before 5.2.5; FortiSwitch 3.3.x before 3.3.3; FortiCache 3.0.x before 3.0
Buffer overflow in the Cookie parser in Fortinet FortiOS 4.x before 4.1.11, 4.2.x before 4.2.13, and 4.3.x before 4.3.9
A product has a SQL injection vulnerability enabling unauthenticated database compromise through improperly neutralized
Remote code execution in Fortinet FortiClientEMS versions 7.4.5 through 7.4.6 allows unauthenticated attackers to execut
An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in
Fortinet FortiAnalyzer and FortiManager contain a critical authentication bypass vulnerability (CVE-2026-24858, CVSS 9.8
Authentication bypass in Fortinet FortiOS, FortiProxy, and FortiSwitchManager allows unauthenticated remote attackers to
The Gzip file parser in AVG Anti-Virus 10.0.0.1190, Bitdefender 7.2, Command Antivirus 5.2.11.5, Emsisoft Anti-Malware 5
The TAR file parser in AhnLab V3 Internet Security 2011.01.18.00, Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7,
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today