{"id":"CVE-2023-48788","published":"2024-03-12T15:15:46Z","modified":"2026-06-17T06:34:58Z","title":"Fortinet FortiClient EMS SQL Injection Vulnerability","vendor":"Fortinet","product":"FortiClient EMS","tier":"core","eol":null,"description":{"text":"A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiClientEMS version 7.2.0 through 7.2.2, FortiClientEMS 7.0.1 through 7.0.10 allows attacker to execute unauthorized code or commands via specially crafted packets.","provenance":"source","from":"NVD"},"summary":{"text":"Fortinet FortiClient EMS contains an SQL injection flaw (improper neutralization of special elements in SQL commands, CWE-89) in versions 7.2.0 through 7.2.2 and 7.0.1 through 7.0.10. An unauthenticated attacker with network access to the server can send specially crafted packets to execute unauthorized commands or code, with no user interaction or special configuration required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:53:22Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.98446,"percentile":0.99918,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2024-03-25","dueDate":"2024-04-15","ransomware":true,"requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://www.fortiguard.com/psirt/FG-IR-24-007;  https://nvd.nist.gov/vuln/detail/CVE-2023-48788","provenance":"source"},"vulncheckKev":{"dateAdded":"2024-03-12","exploitedFirstSeen":"2024-03-12","ransomware":true,"evidence":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-24-007","date":"2024-03-12"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2024-03-25"},{"url":"https://redcanary.com/blog/cve-2023-48788/","date":"2024-04-08"},{"url":"https://www.forescout.com/blog/connectfun-new-exploit-campaign-in-the-wild-targets-media-company/","date":"2024-04-11"},{"url":"https://www.forescout.com/resources/connectfun-threat-briefing/","date":"2024-04-11"},{"url":"https://x.com/MsftSecIntel/status/1781353319341928668","date":"2024-04-19"},{"url":"https://www.rapid7.com/globalassets/_pdfs/research/rapid7_2024_attack_intelligence_report.pdf","date":"2024-05-21"},{"url":"https://www.huntress.com/blog/attack-behaviors","date":"2024-05-30"},{"url":"https://global.ptsecurity.com/en/research/analytics/cybersecurity-threatscape-2024-q1/","date":"2024-06-05"},{"url":"https://blog.qualys.com/vulnerabilities-threat-research/2024/08/06/2024-midyear-threat-landscape-review","date":"2024-08-06"}],"evidenceTotal":62,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"}],"provenance":"machine"},"cwes":[{"id":"CWE-89","name":"Improper Neutralization of Special Elements used in an SQL Command"}],"references":[{"url":"https://fortiguard.com/psirt/FG-IR-24-007","tags":["Vendor Advisory"]},{"url":"https://fortiguard.com/psirt/FG-IR-24-007","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-48788","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: SQL Injection","mappingType":"exploitation_technique","evidence":[],"comment":"This is an SQL injection vulnerability that can be exploited to execute remote code via specially crafted HTTP requests. Adversaries have been observed using this exploit to deploy tools on the target machine.","confidence":"high"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: SQL Injection","mappingType":"primary_impact","evidence":[],"comment":"This is an SQL injection vulnerability that can be exploited to execute remote code via specially crafted HTTP requests. Adversaries have been observed using this exploit to deploy tools on the target machine.","confidence":"high"},{"id":"T1105","name":"Ingress Tool Transfer","tactics":["command-and-control"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: SQL Injection","mappingType":"secondary_impact","evidence":[],"comment":"This is an SQL injection vulnerability that can be exploited to execute remote code via specially crafted HTTP requests. Adversaries have been observed using this exploit to deploy tools on the target machine.","confidence":"high"}],"reports":[{"id":"SRC-733f5480456da2725571","title":"#StopRansomware: Medusa Ransomware","publisher":"cisa.gov","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a","date":null,"mentions":[{"quote":"Fortinet EMS SQL injection vulnerability CVE-2023-48788 [CWE 89: SQL Injection].","start":4864,"end":4944},{"quote":"Fortinet EMS SQL injection vulnerability CVE-2023-48788 [CWE 89: SQL Injection].","start":5279,"end":5359}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2023-52821","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-52821","exploited":true,"exploitedSince":"2024-03-25","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2024-03-18","earliestUrl":"https://github.com/horizon3ai/CVE-2023-48788","repos":[{"name":"horizon3ai/CVE-2023-48788","url":"https://github.com/horizon3ai/CVE-2023-48788","stars":54,"created":"2024-03-18"}]},"metasploit":[{"name":"FortiNet FortiClient Endpoint Management Server FCTID SQLi to RCE","module":"exploit/windows/http/forticlient_ems_fctid_sqli","type":"exploit","disclosureDate":"2024-04-21","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/forticlient_ems_fctid_sqli.rb"}],"nuclei":[{"id":"CVE-2023-48788","name":"Fortinet Forticlient Endpoint Management Server - SQL Injection","severity":"critical","path":"network/cves/2023/CVE-2023-48788.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2023/CVE-2023-48788.yaml"}],"first":{"date":"2024-03-18","source":"PoC-in-GitHub","url":"https://github.com/horizon3ai/CVE-2023-48788"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"source"},{"stage":"primary","techniques":["T1059"],"provenance":"source"},{"stage":"secondary","techniques":["T1105"],"provenance":"source"}],"timeline":[{"date":"2024-03-12","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-48788","provenance":"source"},{"date":"2024-03-12","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://fortiguard.fortinet.com/psirt/FG-IR-24-007","provenance":"source"},{"date":"2024-03-18","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub; later: Metasploit 2024-04-21","url":"https://github.com/horizon3ai/CVE-2023-48788","provenance":"source"},{"date":"2024-03-25","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2024-03-25","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-52821","provenance":"source"}],"speed":{"daysToPublicExploit":6,"firstExploitFrom":"PoC-in-GitHub","daysToKev":13},"priority":{"score":83.7,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 962 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.98,"detail":"percentile 0.9992"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"1 PoC-in-GitHub repo; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}