Skip to content
fr Sign in
4.1 Medium

CVE-2024-35278 A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiPortal…

Description

A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiPortal versions 7.2.4 through 7.2.0 and 7.0.0 through 7.2.8 may allow an authenticated attacker to view the SQL query being run server-side when submitting an HTTP request, via including special elements in said request.

Affected products and versions

Product Affected versions Fixed in
FortiPortal 7.2 7.2.0 → 7.2.4 No fix stated
FortiPortal 7.0 7.0.0 → 7.0.8 No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of FortiPortal

The 25 CVEs of FortiPortal →
CVE-2026-49938 A improper access control vulnerability in Fortinet FortiPortal 7.4.0 through 7.4.7, FortiPortal 7.2.0 through 7.2.8,… 6.2 Medium CVE-2024-40593 A key management errors vulnerability in Fortinet FortiAnalyzer 7.4.0 through 7.4.2, FortiAnalyzer 7.2.0 through… 5.9 Medium CVE-2025-54838 An Incorrect Authorization vulnerability [CWE-863] in FortiPortal 7.4.0 through 7.4.5 may allow an authenticated… 6.4 Medium CVE-2024-45329 A authorization bypass through user-controlled key in Fortinet FortiPortal versions 7.4.0, versions 7.2.0 through 7.2.5,… 3.9 Low
Track this CVE