mediumSecurity Profiles (AV/IPS/WebFilter)

API Calls being detected as SQL Injection extended Attack in FortiGate

Confirmed 7/20/2026

Problem

There was a case where WAF has blocked the Access to a publicly accessible Server.

Symptoms

after entering the Login credentials and the OTP code the page stays white and no login is successful. After looking at the security logs of FortiGate it has been noticed that the API call has been falsely identifed as an SQL injection extended attack and hence blocked.

Environment

FortiGate

FortiOS version

All versions

Root Cause

API Calls being detected as SQL Injection

Solution

To solve the issue and allow this legitime access the API must be overriden in the WAF profile as a trusted  Entry.  Cli command:  

config waf profile  
    edit "profile name"  
        config signature  
       config url-access  
               edit 1  
                 set address "object name"  
                 set log enable  
                 config access-pattern  
                       edit 1  
                         set pattern "API link" for example : /webapi/entry.cgi/  
     end  
end  
     end  
end

Community rating

— / 5 (0)

Discussion (0)

No comments yet.