Loading vulnerability…
CVE-2023-48788 is a critical SQL injection vulnerability in Fortinet FortiClient Enterprise Management Server (EMS), affecting the DB2 Administration Server (DAS) component in FortiClient EMS 7.2.0 through 7.2.2 and 7.0.1 through 7.0.10. The flaw is caused by improper neutralization of special elements in SQL commands, allowing attacker-controlled input from specially crafted network requests to be incorporated into backend SQL statements. Available reporting indicates the FortiClient EMS service handling inbound requests can pass malicious input to the component that translates requests into SQL queries for the backend database, enabling unauthorized SQL execution. In observed exploitation, attackers used the SQL injection to enable Microsoft SQL Server xp_cmdshell and then execute operating system commands, resulting in remote code execution on the vulnerable server.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository contains a proof-of-concept exploit for CVE-2023-48788, a SQL injection vulnerability in Fortinet FortiClient EMS. The main file, CVE-2023-48788.py, is a Python script that connects to a specified FortiClient EMS server over SSL/TCP (default port 8013) and sends a specially crafted registration message containing a SQL injection payload ("' OR 1=1 --"). The script then checks the server's response for the presence of the string 'KA_INTERVAL' to determine if the target is vulnerable. The exploit does not provide post-exploitation capabilities or a shell; it is designed to test for the presence of the vulnerability. The repository also includes a README.md with usage instructions and background information. No hardcoded IPs or domains are present; the target is specified by the user at runtime.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
42 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A vulnerability in Fortinet FortiClient EMS identified in the report as another notable initial access vector used by Medusa affiliates against unpatched internet-facing software.
A SQL injection vulnerability leading to remote code execution in Fortinet FortiClient EMS.
A specific Fortinet EMS vulnerability that the INC ransomware group is described as exploiting as part of its intrusion methods.
A vulnerability in Fortinet EMS identified in the report as an initial access vector used by INC ransomware actors.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.