FortiWLM - SQL Injection in script handlers


An improper neutralization of special elements [CWE-79] used in an SQL command vulnerability ('SQL Injection') [CWE-89] in FortiWLM may allow an authenticated attacker to disclose sensitive information via crafted HTTP requests to various controllers.

Affected Products

FortiWLM version 8.6.1 and below are impacted


Upgrade to FortiWLM version 8.6.2 or earlier


Internally discovered and reported by Mattia Fecit of the Fortinet Product Security team.