CVE-2024-5276

An attacker sends a specially crafted query containing malicious SQL code that is improperly validated by the application (CWE-20, CWE-89). This allows injection of custom SQL instructions directly into queries executed by the database. As a result, it is possible to create administrative accounts and delete or modify any data in the application database. Data exfiltration through this specific vulnerability is not possible.

An attacker can create unauthorized administrative accounts and modify or delete data in the application database, leading to complete loss of data integrity and takeover of application control.

Apply patches available from the vendor according to references (Fortra advisory FI-2024-008 dated 2024-06-24). If immediate update is not possible, as a temporary measure, disable anonymous access to the Workflow system to limit risk to authenticated users.

All versions of Fortra FileCatalyst Workflow from 5.1.6 Build 135 and earlier. Unauthenticated exploitation is possible only when anonymous access is enabled in the system; otherwise, an authenticated user account is required.