Loading vulnerability…
CVE-2023-48788 is a critical unauthenticated SQL injection vulnerability in Fortinet FortiClient Enterprise Management Server (EMS). The flaw affects FortiClient EMS 7.2.0 through 7.2.2 and 7.0.1 through 7.0.10, and multiple reports also indicate broader affected legacy branches. The issue is attributed to improper neutralization of special elements in SQL commands in the DB2 Administration Server (DAS) component. In observed exploitation chains, the FortiClient EMS service handling inbound requests translates attacker-controlled input into SQL statements executed against the backend Microsoft SQL Server database. By sending specially crafted network requests, a remote attacker can inject arbitrary SQL, modify database behavior, and in practical exploitation enable operating-system command execution through SQL Server functionality such as xp_cmdshell. The vulnerability has been publicly reported as actively exploited in the wild and has been used for initial access by ransomware and state-linked threat actors.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository contains a proof-of-concept exploit for CVE-2023-48788, a SQL injection vulnerability in Fortinet FortiClient EMS. The main file, CVE-2023-48788.py, is a Python script that connects to a specified FortiClient EMS server over SSL/TCP (default port 8013) and sends a specially crafted registration message containing a SQL injection payload ("' OR 1=1 --"). The script then checks the server's response for the presence of the string 'KA_INTERVAL' to determine if the target is vulnerable. The exploit does not provide post-exploitation capabilities or a shell; it is designed to test for the presence of the vulnerability. The repository also includes a README.md with usage instructions and background information. No hardcoded IPs or domains are present; the target is specified by the user at runtime.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
44 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Fortinet FortiClient EMS vulnerability previously exploited by Storm-1175 in campaigns that deployed Medusa ransomware.
A vulnerability in Fortinet FortiClient EMS identified in the report as another notable initial access vector used by Medusa affiliates against unpatched internet-facing software.
A SQL injection vulnerability leading to remote code execution in Fortinet FortiClient EMS.
A specific Fortinet EMS vulnerability that the INC ransomware group is described as exploiting as part of its intrusion methods.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.