alirezac0/cve-2026-21643Python PoC and Nuclei template for detecting pre-authentication SQL injection in FortiClient EMS 7.4.4, with safe error-based and time-based check methods.
This repository contains detection tools for CVE-2026-21643, a pre-authentication SQL Injection vulnerability in FortiClient EMS 7.4.4.
The vulnerability exists in the /api/v1/init_consts and /api/v1/auth/signin endpoints, where the Site HTTP header is passed directly into a PostgreSQL SET search_path query without sanitization.
cve_2026_21643.py: A Python script to check for the vulnerability using both error-based (safe) and time-based (causes lockout) methods.CVE-2026-21643.yaml: A ProjectDiscovery Nuclei template utilizing the safe, error-based extraction method.Install the required dependencies:
pip install -r requirements.txt
Run the script against a target:
# Default (Safe Error-Based Check on /api/v1/init_consts)
python3 cve_2026_21643.py -u https://target.com
# Time-Based Check on /api/v1/auth/signin (Warning: Triggers lockout after 3 attempts)
python3 cve_2026_21643.py -u https://target.com -e signin
# Check both endpoints
python3 cve_2026_21643.py -u https://target.com] -e both
You can run the included YAML template directly using Nuclei:
nuclei -t CVE-2026-21643.yaml -u https://target.com