CVE-2020-29015 – Fortinet / FortiWeb – SQLi

Click the icon to Follow me:- twitterTelegramRedditDiscord

Summary:

CVE-2020-29015 is a structured query language injection (SQLi) vulnerability impacting multiple versions of Fortinet FortiWeb. A proof of concept (PoC) was not observed publicly or in the underground. A successful exploitation of this vulnerability would allow an unauthenticated attacker to remotely execute arbitrary SQL queries on the system via specially crafted request containing manipulated Authorization header.

PoC Links(if available):

Known Counter Measures:

Fortinet addressed the vulnerability in FortiWeb versions 6.3.8 or above and FortiWeb version 6.2.4 or above.

Links to patches(if available)

https://www.fortiguard.com/psirt/FG-IR-20-124

Available for Amazon Prime