Tag

#forticlient-ems

1 post tagged #forticlient-ems.

Field Note · May 20, 2026 · Colten Anderson

FortiClient EMS CVE-2023-48788: a SQL injection that talks the database into running SYSTEM commands

When a product runs on Microsoft SQL Server, a SQL injection is rarely just a data leak. The attacker turns on xp_cmdshell from inside the injection and gets OS command execution. On FortiClient EMS that's unauthenticated, as SYSTEM. Here's how to check, patch, and detect it.