SQL Injection via JSON RPC API

An attacker with administrative or high-privilege credentials could manipulate the FortiAnalyzer or FortiManager database through SQL injection, potentially accessing sensitive logs about your network security events, firewall rules, and system configurations, or corrupting security audit records.

Organizations using FortiAnalyzer or FortiManager for security log management and device administration should prioritize this. These products are typically found in network operations centers managing firewall, intrusion detection, and security event monitoring across enterprise and critical infrastructure networks.

An attacker with high-privilege credentials (such as an administrative account) would authenticate to the JSON RPC API and submit specially crafted API requests containing SQL injection payloads. The vulnerable API endpoint would pass user input directly to database queries without proper sanitization, allowing the attacker to extract or modify database contents.