CVE-2024-54026
Published: 11 March 2025
Summary
CVE-2024-54026 is a medium-severity SQL Injection (CWE-89) vulnerability in Fortinet Fortisandbox. Its CVSS base score is 4.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 44.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly implements input validation mechanisms to neutralize special elements in SQL commands, preventing SQL injection via crafted HTTP requests.
Requires timely identification, reporting, and correction of flaws like this SQL injection vulnerability through patching.
Monitors and scans for vulnerabilities such as CVE-2024-54026 to identify and prioritize remediation efforts.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection via crafted HTTP requests in a network-accessible web application (FortiSandbox) directly enables exploitation of public-facing applications for initial access.
NVD Description
An improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiSandbox 4.4.0 through 4.4.6, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions, FortiSandbox 3.2 all versions, FortiSandbox 3.1 all versions, FortiSandbox 3.0 all versions, FortiSandbox…
more
Cloud 24.1 allows attacker to execute unauthorized code or commands via specifically crafted HTTP requests.
Deeper analysisAI
CVE-2024-54026 is an SQL injection vulnerability (CWE-89) due to improper neutralization of special elements in SQL commands. It affects Fortinet FortiSandbox versions 4.4.0 through 4.4.6, all versions of FortiSandbox 4.2, 4.0, 3.2, 3.1, 3.0, and FortiSandbox Cloud 24.1. The flaw allows attackers to execute unauthorized code or commands through specifically crafted HTTP requests. The vulnerability has a CVSS v3.1 base score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), indicating low severity with limited confidentiality impact.
An attacker with low privileges (PR:L) can exploit this over the network (AV:N) with low complexity (AC:L) and no user interaction required. By sending crafted HTTP requests, the attacker can inject malicious SQL, potentially leading to unauthorized code or command execution, though the scoped impact is confined to low confidentiality per the CVSS vector.
Fortinet has published advisory FG-IR-24-353 at https://fortiguard.fortinet.com/psirt/FG-IR-24-353, which provides details on the vulnerability and recommended mitigations or patches.
Details
- CWE(s)